diff --git a/.github/workflows/quicktest.yml b/.github/workflows/quicktest.yml
index cacaf96b3..fae653090 100644
--- a/.github/workflows/quicktest.yml
+++ b/.github/workflows/quicktest.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Start test server
         run: |
           PORT=8080 vendor/bin/start.sh
-          echo "REQUESTS_TEST_HOST_HTTP=localhost:8080" >> $GITHUB_ENV
+          echo "REQUESTS_TEST_HOST_HTTP=localhost:8080" >> "$GITHUB_ENV"
 
       - name: Ping localhost domain
         run: ping -c1 localhost
@@ -76,10 +76,10 @@ jobs:
         run: |
           PORT=9002 tests/utils/proxy/start.sh
           PORT=9003 AUTH="test:pass" tests/utils/proxy/start.sh
-          echo "REQUESTS_HTTP_PROXY=localhost:9002" >> $GITHUB_ENV
-          echo "REQUESTS_HTTP_PROXY_AUTH=localhost:9003" >> $GITHUB_ENV
-          echo "REQUESTS_HTTP_PROXY_AUTH_USER=test" >> $GITHUB_ENV
-          echo "REQUESTS_HTTP_PROXY_AUTH_PASS=pass" >> $GITHUB_ENV
+          echo "REQUESTS_HTTP_PROXY=localhost:9002" >> "$GITHUB_ENV"
+          echo "REQUESTS_HTTP_PROXY_AUTH=localhost:9003" >> "$GITHUB_ENV"
+          echo "REQUESTS_HTTP_PROXY_AUTH_USER=test" >> "$GITHUB_ENV"
+          echo "REQUESTS_HTTP_PROXY_AUTH_PASS=pass" >> "$GITHUB_ENV"
 
       - name: Ensure the HTTPS test instance on Render is spun up
         run: curl -s -I https://requests-test-server.onrender.com/ > /dev/null
@@ -92,7 +92,7 @@ jobs:
 
       - name: Grab PHPUnit version
         id: phpunit_version
-        run: echo "VERSION=$(vendor/bin/phpunit --version | grep --only-matching --max-count=1 --extended-regexp '\b[0-9]+\.[0-9]+')" >> $GITHUB_OUTPUT
+        run: echo "VERSION=$(vendor/bin/phpunit --version | grep --only-matching --max-count=1 --extended-regexp '\b[0-9]+\.[0-9]+')" >> "$GITHUB_OUTPUT"
 
       - name: Run the unit tests (PHPUnit < 10)
         if: ${{ ! startsWith( steps.phpunit_version.outputs.VERSION, '10.' ) }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index aaa8bb67c..4e04b5de2 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -91,7 +91,7 @@ jobs:
       - name: Start test server
         run: |
           PORT=8080 vendor/bin/start.sh
-          echo "REQUESTS_TEST_HOST_HTTP=localhost:8080" >> $GITHUB_ENV
+          echo "REQUESTS_TEST_HOST_HTTP=localhost:8080" >> "$GITHUB_ENV"
 
       - name: Ping localhost domain
         run: ping -c1 localhost
@@ -100,10 +100,10 @@ jobs:
         run: |
           PORT=9002 tests/utils/proxy/start.sh
           PORT=9003 AUTH="test:pass" tests/utils/proxy/start.sh
-          echo "REQUESTS_HTTP_PROXY=localhost:9002" >> $GITHUB_ENV
-          echo "REQUESTS_HTTP_PROXY_AUTH=localhost:9003" >> $GITHUB_ENV
-          echo "REQUESTS_HTTP_PROXY_AUTH_USER=test" >> $GITHUB_ENV
-          echo "REQUESTS_HTTP_PROXY_AUTH_PASS=pass" >> $GITHUB_ENV
+          echo "REQUESTS_HTTP_PROXY=localhost:9002" >> "$GITHUB_ENV"
+          echo "REQUESTS_HTTP_PROXY_AUTH=localhost:9003" >> "$GITHUB_ENV"
+          echo "REQUESTS_HTTP_PROXY_AUTH_USER=test" >> "$GITHUB_ENV"
+          echo "REQUESTS_HTTP_PROXY_AUTH_PASS=pass" >> "$GITHUB_ENV"
 
       - name: Ensure the HTTPS test instance on Render is spun up
         run: curl -s -I https://requests-test-server.onrender.com/ > /dev/null
@@ -116,7 +116,7 @@ jobs:
 
       - name: Grab PHPUnit version
         id: phpunit_version
-        run: echo "VERSION=$(vendor/bin/phpunit --version | grep --only-matching --max-count=1 --extended-regexp '\b[0-9]+\.[0-9]+')" >> $GITHUB_OUTPUT
+        run: echo "VERSION=$(vendor/bin/phpunit --version | grep --only-matching --max-count=1 --extended-regexp '\b[0-9]+\.[0-9]+')" >> "$GITHUB_OUTPUT"
 
       - name: Run the unit tests, no code coverage (PHPUnit < 10)
         if: ${{  matrix.coverage == false && ! startsWith( steps.phpunit_version.outputs.VERSION, '10.' ) }}
diff --git a/.github/workflows/update-cacert.yml b/.github/workflows/update-cacert.yml
index d7f1c85f0..6a8b37848 100644
--- a/.github/workflows/update-cacert.yml
+++ b/.github/workflows/update-cacert.yml
@@ -40,18 +40,18 @@ jobs:
           PR_NUM: ${{ github.event.pull_request.number }}
         run: |
           if [[ "${{ github.event_name }}" == 'schedule' ]]; then
-            echo "BASE=develop" >> $GITHUB_OUTPUT
-            echo "PR_BRANCH=feature/auto-update-cacert" >> $GITHUB_OUTPUT
+            echo "BASE=develop" >> "$GITHUB_OUTPUT"
+            echo "PR_BRANCH=feature/auto-update-cacert" >> "$GITHUB_OUTPUT"
           elif [[ "${{ github.event_name }}" == 'push' ]]; then
             # Pull requests should always go to develop, even when triggered via a push to stable.
-            echo "BASE=develop" >> $GITHUB_OUTPUT
-            echo "PR_BRANCH=feature/auto-update-cacert" >> $GITHUB_OUTPUT
+            echo "BASE=develop" >> "$GITHUB_OUTPUT"
+            echo "PR_BRANCH=feature/auto-update-cacert" >> "$GITHUB_OUTPUT"
           elif [[ $PR_NUM != '' ]]; then # = PR or manual (re-)run for a workflow triggered by a PR.
-            echo "BASE=$HEAD_REF" >> $GITHUB_OUTPUT
-            echo "PR_BRANCH=feature/auto-update-cacert-$PR_NUM" >> $GITHUB_OUTPUT
+            echo "BASE=$HEAD_REF" >> "$GITHUB_OUTPUT"
+            echo "PR_BRANCH=feature/auto-update-cacert-$PR_NUM" >> "$GITHUB_OUTPUT"
           else # = manual run.
-            echo "BASE=$HEAD_REF" >> $GITHUB_OUTPUT
-            echo "PR_BRANCH=feature/auto-update-cacert-misc" >> $GITHUB_OUTPUT
+            echo "BASE=$HEAD_REF" >> "$GITHUB_OUTPUT"
+            echo "PR_BRANCH=feature/auto-update-cacert-misc" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Checkout code
@@ -83,7 +83,7 @@ jobs:
       # http://man7.org/linux/man-pages/man1/date.1.html
       - name: "Get date"
         id: get-date
-        run: echo "DATE=$(/bin/date -u "+%F")" >> $GITHUB_OUTPUT
+        run: echo "DATE=$(/bin/date -u "+%F")" >> "$GITHUB_OUTPUT"
 
       - name: Create pull request
         uses: peter-evans/create-pull-request@v7
diff --git a/.github/workflows/update-website.yml b/.github/workflows/update-website.yml
index ddb1a5a78..ba638e45f 100644
--- a/.github/workflows/update-website.yml
+++ b/.github/workflows/update-website.yml
@@ -43,9 +43,9 @@ jobs:
           REF: ${{ github.ref }}
         run: |
           if [ "${{ github.event_name }}" == "pull_request" ]; then
-            echo "BRANCH=$REF" >> $GITHUB_OUTPUT
+            echo "BRANCH=$REF" >> "$GITHUB_OUTPUT"
           else
-            echo 'BRANCH=stable' >> $GITHUB_OUTPUT
+            echo 'BRANCH=stable' >> "$GITHUB_OUTPUT"
           fi
 
       - name: Checkout code
@@ -101,15 +101,15 @@ jobs:
           TAG_NAME: ${{ github.event.release.tag_name }}
         run: |
           if [ "${{ github.event_name }}" == "pull_request" ]; then
-            echo "REF=$REF_NAME" >> $GITHUB_OUTPUT
-            echo 'PR_TITLE_PREFIX=[TEST | DO NOT MERGE] ' >> $GITHUB_OUTPUT
-            echo 'PR_BODY=Test run for the website update after changes to the automated scripts.' >> $GITHUB_OUTPUT
-            echo 'DRAFT=always-true' >> $GITHUB_OUTPUT
+            echo "REF=$REF_NAME" >> "$GITHUB_OUTPUT"
+            echo 'PR_TITLE_PREFIX=[TEST | DO NOT MERGE] ' >> "$GITHUB_OUTPUT"
+            echo 'PR_BODY=Test run for the website update after changes to the automated scripts.' >> "$GITHUB_OUTPUT"
+            echo 'DRAFT=always-true' >> "$GITHUB_OUTPUT"
           else
-            echo "REF=$TAG_NAME" >> $GITHUB_OUTPUT
-            echo 'PR_TITLE_PREFIX=' >> $GITHUB_OUTPUT
-            echo "PR_BODY=Website update after the release of Requests $TAG_NAME." >> $GITHUB_OUTPUT
-            echo 'DRAFT=false' >> $GITHUB_OUTPUT
+            echo "REF=$TAG_NAME" >> "$GITHUB_OUTPUT"
+            echo 'PR_TITLE_PREFIX=' >> "$GITHUB_OUTPUT"
+            echo "PR_BODY=Website update after the release of Requests $TAG_NAME." >> "$GITHUB_OUTPUT"
+            echo 'DRAFT=false' >> "$GITHUB_OUTPUT"
           fi
 
       - name: Checkout code