diff --git a/.github/workflows/_build-app.yml b/.github/workflows/_build-app.yml
index 871e28239..445608230 100644
--- a/.github/workflows/_build-app.yml
+++ b/.github/workflows/_build-app.yml
@@ -81,9 +81,11 @@ jobs:
           make save.requirements
 
       - name: Build app
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}build.app
-          make ${{ inputs.make_target_prefix }}save.app
+          make "$MAKE_TARGET_PREFIX"build.app
+          make "$MAKE_TARGET_PREFIX"save.app
 
   build-test-app:
     name: Build Test App
@@ -143,6 +145,8 @@ jobs:
           make save.test-requirements
 
       - name: Build Test App
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}build.test-app
-          make ${{ inputs.make_target_prefix }}save.test-app
+          make "$MAKE_TARGET_PREFIX"build.test-app
+          make "$MAKE_TARGET_PREFIX"save.test-app
diff --git a/.github/workflows/_create-release-pr.yml b/.github/workflows/_create-release-pr.yml
index 0c4d7ce17..4a954df54 100644
--- a/.github/workflows/_create-release-pr.yml
+++ b/.github/workflows/_create-release-pr.yml
@@ -28,18 +28,24 @@ jobs:
           git_config_global: true
 
       - name: Create release branch
-        run: git checkout -b release/${{ github.event.inputs.versionName }}
+        env:
+          VERSION_NAME: ${{ github.event.inputs.versionName }}
+        run: git checkout -b release/"$VERSION_NAME"
       - name: Update version file
         id: make-commit
+        env:
+          VERSION_NAME: ${{ github.event.inputs.versionName }}
         run: |
-          echo ${{ github.event.inputs.versionName }} > VERSION
+          echo "$VERSION_NAME" > VERSION
           echo -n $(tr -d '\n' < VERSION) > VERSION
           git add VERSION
-          git commit -S --message "Prepare release ${{ github.event.inputs.versionName }}"
+          git commit -S --message "Prepare release $VERSION_NAME"
           echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Push release branch
-        run: git push origin release/${{ github.event.inputs.versionName }}
+        env:
+          VERSION_NAME: ${{ github.event.inputs.versionName }}
+        run: git push origin release/"$VERSION_NAME"
       - name: Create pull request into main
         uses: thomaseizinger/create-pull-request@1.3.1
         with:
diff --git a/.github/workflows/_create-release.yml b/.github/workflows/_create-release.yml
index 866f2e43d..748a948b6 100644
--- a/.github/workflows/_create-release.yml
+++ b/.github/workflows/_create-release.yml
@@ -24,6 +24,7 @@ jobs:
       - name: Create GitHub Release
         env:
           GITHUB_TOKEN: ${{ secrets.CODECOV_RELEASE_PAT }}
+          TAG_TO_PREPEND: ${{ inputs.tag_to_prepend }}
         run: |
-          gh release create ${{ inputs.tag_to_prepend }}${{ steps.get-release-vars.outputs.release_version }} --title "Release ${{ steps.get-release-vars.outputs.release_version }}" --notes "Autogenerated for ${{ steps.get-release-vars.outputs.release_version }}. Created for ${{ github.event.pull_request.html_url }}" --generate-notes
+          gh release create "$TAG_TO_PREPEND"${{ steps.get-release-vars.outputs.release_version }} --title "Release ${{ steps.get-release-vars.outputs.release_version }}" --notes "Autogenerated for ${{ steps.get-release-vars.outputs.release_version }}. Created for ${{ github.event.pull_request.html_url }}" --generate-notes
 
diff --git a/.github/workflows/_push-env.yml b/.github/workflows/_push-env.yml
index f4795d490..ca86f184d 100644
--- a/.github/workflows/_push-env.yml
+++ b/.github/workflows/_push-env.yml
@@ -76,14 +76,19 @@ jobs:
           echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://us-docker.pkg.dev
 
       - name: Push ${{ inputs.environment }}
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
+          ENVIRONMENT: ${{ inputs.environment }}
         run: |
-          make ${{ inputs.make_target_prefix }}tag.${{ inputs.environment }}
-          make ${{ inputs.make_target_prefix }}push.${{ inputs.environment }}
+          make "$MAKE_TARGET_PREFIX"tag."$ENVIRONMENT"
+          make "$MAKE_TARGET_PREFIX"push."$ENVIRONMENT"
       - name: Push latest
         if: inputs.environment == 'production'
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}tag.latest
-          make ${{ inputs.make_target_prefix }}push.latest
+          make "$MAKE_TARGET_PREFIX"tag.latest
+          make "$MAKE_TARGET_PREFIX"push.latest
 
       - name: Create Sentry release
         if: inputs.create_sentry_release
@@ -116,17 +121,21 @@ jobs:
             ${{ inputs.output_directory }}/app.tar
           key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.run_id }}
       - name: Load built image
+        env:
+          OUTPUT_DIRECTORY: ${{ inputs.output_directory }}
         run: |
-          docker load --input ${{ inputs.output_directory }}/app.tar
+          docker load --input "${OUTPUT_DIRECTORY}"/app.tar
       - name: Log in to Docker Hub
         uses: docker/login-action@v3.1.0
         with:
           username: ${{ secrets.CODECOV_DEVOPS_DOCKER_USERNAME }}
           password: ${{ secrets.CODECOV_DEVOPS_DOCKER_PASSWORD }}
       - name: Push Rolling
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}tag.rolling
-          make ${{ inputs.make_target_prefix }}push.rolling
+          make "$MAKE_TARGET_PREFIX"tag.rolling
+          make "$MAKE_TARGET_PREFIX"push.rolling
   release:
     name: Push Release Image
     if: inputs.push_release == true && github.repository_owner == 'codecov' && !github.event.pull_request.head.repo.fork
@@ -147,15 +156,19 @@ jobs:
             ${{ inputs.output_directory }}/app.tar
           key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.run_id }}
       - name: Load built image
+        env:
+          OUTPUT_DIRECTORY: ${{ inputs.output_directory }}
         run: |
-          docker load --input ${{ inputs.output_directory }}/app.tar
+          docker load --input "${OUTPUT_DIRECTORY}"/app.tar
       - name: Log in to Docker Hub
         uses: docker/login-action@v3.1.0
         with:
           username: ${{ secrets.CODECOV_DEVOPS_DOCKER_USERNAME }}
           password: ${{ secrets.CODECOV_DEVOPS_DOCKER_PASSWORD }}
       - name: Push release
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}tag.release
-          make ${{ inputs.make_target_prefix }}push.release
+          make "$MAKE_TARGET_PREFIX"tag.release
+          make "$MAKE_TARGET_PREFIX"push.release
 
diff --git a/.github/workflows/_run-tests.yml b/.github/workflows/_run-tests.yml
index ae152898e..84dc3b544 100644
--- a/.github/workflows/_run-tests.yml
+++ b/.github/workflows/_run-tests.yml
@@ -58,20 +58,30 @@ jobs:
           sudo curl -SL https://github.com/docker/compose/releases/download/v2.20.0/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
           sudo chmod +x /usr/local/bin/docker-compose
       - name: Bring test env up
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}test_env.up
+          make "$MAKE_TARGET_PREFIX"test_env.up
       - name: Prepare for tests
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}test_env.prepare
-          make ${{ inputs.make_target_prefix }}test_env.check_db
+          make "$MAKE_TARGET_PREFIX"test_env.prepare
+          make "$MAKE_TARGET_PREFIX"test_env.check_db
 
       - name: Run unit tests
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
+          PYTEST_ROOTDIR: ${{ inputs.pytest_rootdir }}
         run: |
-          make ${{ inputs.make_target_prefix }}test_env.run_unit PYTEST_ROOTDIR=${{ inputs.pytest_rootdir }}
+          make "$MAKE_TARGET_PREFIX"test_env.run_unit PYTEST_ROOTDIR="$PYTEST_ROOTDIR"
       - name: Run integration tests
         if: ${{ !cancelled() && inputs.run_integration == true }}
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
+          PYTEST_ROOTDIR: ${{ inputs.pytest_rootdir }}
         run: |
-          make ${{ inputs.make_target_prefix }}test_env.run_integration PYTEST_ROOTDIR=${{ inputs.pytest_rootdir }}
+          make "$MAKE_TARGET_PREFIX"test_env.run_integration PYTEST_ROOTDIR="$PYTEST_ROOTDIR"
 
       - uses: actions/upload-artifact@v4
         if: ${{ !cancelled() }}
diff --git a/.github/workflows/_self-hosted.yml b/.github/workflows/_self-hosted.yml
index 07c639d91..bb2089dac 100644
--- a/.github/workflows/_self-hosted.yml
+++ b/.github/workflows/_self-hosted.yml
@@ -88,15 +88,19 @@ jobs:
           make save.requirements
 
       - name: Load built image
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         if: ${{ steps.cache-self-hosted.outputs.cache-hit == 'true' }}
         run: |
-          make ${{ inputs.make_target_prefix }}load.self-hosted
+          make "$MAKE_TARGET_PREFIX"load.self-hosted
 
       - name: Build self hosted
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         if: ${{ steps.cache-self-hosted.outputs.cache-hit != 'true' }}
         run: |
-          make ${{ inputs.make_target_prefix }}build.self-hosted
-          make ${{ inputs.make_target_prefix }}save.self-hosted
+          make "$MAKE_TARGET_PREFIX"build.self-hosted
+          make "$MAKE_TARGET_PREFIX"save.self-hosted
 
   self-hosted:
     name: Push Self Hosted Image
@@ -121,17 +125,21 @@ jobs:
             ${{ inputs.output_directory }}/self-hosted.tar
           key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.run_id }}
       - name: Load built image
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}load.self-hosted
+          make "$MAKE_TARGET_PREFIX"load.self-hosted
       - name: Log in to Docker Hub
         uses: docker/login-action@v3.1.0
         with:
           username: ${{ secrets.CODECOV_DEVOPS_DOCKER_USERNAME }}
           password: ${{ secrets.CODECOV_DEVOPS_DOCKER_PASSWORD }}
       - name: Push Self Hosted Rolling
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}tag.self-hosted-rolling
-          make ${{ inputs.make_target_prefix }}push.self-hosted-rolling
+          make "$MAKE_TARGET_PREFIX"tag.self-hosted-rolling
+          make "$MAKE_TARGET_PREFIX"push.self-hosted-rolling
   self-hosted-release:
     name: Push Self Hosted Release Image
     needs: [build-self-hosted]
@@ -155,15 +163,19 @@ jobs:
             ${{ inputs.output_directory }}/self-hosted.tar
           key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.run_id }}
       - name: Load built image
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}load.self-hosted
+          make "$MAKE_TARGET_PREFIX"load.self-hosted
       - name: Log in to Docker Hub
         uses: docker/login-action@v3.1.0
         with:
           username: ${{ secrets.CODECOV_DEVOPS_DOCKER_USERNAME }}
           password: ${{ secrets.CODECOV_DEVOPS_DOCKER_PASSWORD }}
       - name: Push self hosted release
+        env:
+          MAKE_TARGET_PREFIX: ${{ inputs.make_target_prefix }}
         run: |
-          make ${{ inputs.make_target_prefix }}tag.self-hosted-release
-          make ${{ inputs.make_target_prefix }}push.self-hosted-release
+          make "$MAKE_TARGET_PREFIX"tag.self-hosted-release
+          make "$MAKE_TARGET_PREFIX"push.self-hosted-release