diff --git a/actions/install-nfpm/action.yml b/actions/install-nfpm/action.yml
index 6f992ef..83b069c 100644
--- a/actions/install-nfpm/action.yml
+++ b/actions/install-nfpm/action.yml
@@ -16,11 +16,25 @@ runs:
   steps:
     - name: Download and verify nfpm
       shell: bash
+      env:
+        NFPM_VERSION: ${{ inputs.nfpm-version }}
+        DEB_ARCH: ${{ inputs.deb-arch }}
       run: |
-        deb_url="https://github.com/goreleaser/nfpm/releases/download/v${{ inputs.nfpm-version }}/nfpm_${{ inputs.nfpm-version }}_${{ inputs.deb-arch }}.deb"
+        version="$NFPM_VERSION"
+        arch="$DEB_ARCH"
+        if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+          echo "::error::invalid nfpm-version '$version'"
+          exit 1
+        fi
+        case "$arch" in
+          amd64 | arm64) ;;
+          *) echo "::error::invalid deb-arch '$arch'"; exit 1 ;;
+        esac
+
+        deb_url="https://github.com/goreleaser/nfpm/releases/download/v${version}/nfpm_${version}_${arch}.deb"
         curl --proto '=https' --proto-redir =https -fsSL -o "$RUNNER_TEMP/nfpm.deb" "$deb_url"
 
-        case "${{ inputs.nfpm-version }}:${{ inputs.deb-arch }}" in
+        case "${version}:${arch}" in
           "2.48.0:amd64")
             expected="787af76e172dd5fc7cedf4d7c5a090a2f62be9001557a4db1103e270f90ddefd"
             ;;
@@ -34,8 +48,8 @@ runs:
             expected="27419eb382695a7942be8ad52259f3ec1854fad001b3ae4baed34ce39a223b97"
             ;;
           *)
-            curl --proto '=https' --proto-redir =https -fsSL -o "$RUNNER_TEMP/checksums.txt" "https://github.com/goreleaser/nfpm/releases/download/v${{ inputs.nfpm-version }}/checksums.txt"
-            expected=$(grep -E "nfpm_${{ inputs.nfpm-version }}_${{ inputs.deb-arch }}\.deb" "$RUNNER_TEMP/checksums.txt" | awk '{print $1}')
+            curl --proto '=https' --proto-redir =https -fsSL -o "$RUNNER_TEMP/checksums.txt" "https://github.com/goreleaser/nfpm/releases/download/v${version}/checksums.txt"
+            expected=$(grep -E "nfpm_${version}_${arch}\.deb" "$RUNNER_TEMP/checksums.txt" | awk '{print $1}')
             ;;
         esac
 
diff --git a/actions/install-trunk/action.yml b/actions/install-trunk/action.yml
index 33b9419..b1e8edc 100644
--- a/actions/install-trunk/action.yml
+++ b/actions/install-trunk/action.yml
@@ -12,10 +12,22 @@ runs:
   steps:
     - name: Install trunk
       shell: bash
+      env:
+        TRUNK_VERSION: ${{ inputs.trunk-version }}
       run: |
-        tar_url="https://github.com/trunk-rs/trunk/releases/download/v${{ inputs.trunk-version }}/trunk-x86_64-unknown-linux-gnu.tar.gz"
+        version="$TRUNK_VERSION"
+        # Restrict the version to a single safe release-tag component. This keeps
+        # the value from carrying slashes or other URL path-traversal segments
+        # that could redirect downloads to an attacker-controlled repository. The
+        # bash regex anchors the whole string, so values containing a newline are
+        # rejected (unlike a line-oriented grep check).
+        if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+          echo "::error::invalid trunk-version '$version'"
+          exit 1
+        fi
+        tar_url="https://github.com/trunk-rs/trunk/releases/download/v${version}/trunk-x86_64-unknown-linux-gnu.tar.gz"
         curl --proto '=https' --proto-redir =https -fsSL -o "$RUNNER_TEMP/trunk.tar.gz" "$tar_url"
-        case "${{ inputs.trunk-version }}" in
+        case "$version" in
           "0.21.14")
             expected="f2b4680cd239693a646a2795e4633c625328d7b2a044fbe749fa3a2fe9e7036b"
             ;;
diff --git a/actions/install-wix/action.yml b/actions/install-wix/action.yml
index 288e4ea..f344826 100644
--- a/actions/install-wix/action.yml
+++ b/actions/install-wix/action.yml
@@ -16,9 +16,16 @@ runs:
   steps:
     - name: Install WiX
       shell: pwsh
+      env:
+        WIX_VERSION: ${{ inputs.wix-version }}
+        INSTALL_EXTENSIONS: ${{ inputs.install-extensions }}
       run: |
-        $version = "${{ inputs.wix-version }}"
+        $version = $env:WIX_VERSION
+        if ($version -notmatch '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?\z') {
+          Write-Output "::error::invalid wix-version '$version'"
+          exit 1
+        }
         dotnet tool install --global wix --version $version
-        if ("${{ inputs.install-extensions }}" -eq "true") {
+        if ($env:INSTALL_EXTENSIONS -eq "true") {
           wix extension add -g "WixToolset.UI.wixext/$version" "WixToolset.Util.wixext/$version"
         }
diff --git a/actions/packaging-lint/action.yml b/actions/packaging-lint/action.yml
index 0ac9bdc..a40cd3d 100644
--- a/actions/packaging-lint/action.yml
+++ b/actions/packaging-lint/action.yml
@@ -12,18 +12,25 @@ runs:
   steps:
     - name: Install tools
       shell: bash
+      env:
+        ACTIONLINT_VERSION: ${{ inputs.actionlint-version }}
       run: |
+        version="$ACTIONLINT_VERSION"
+        if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+          echo "::error::invalid actionlint-version '$version'"
+          exit 1
+        fi
         sudo apt-get update
         sudo apt-get install -y --no-install-recommends shellcheck desktop-file-utils appstream libxml2-utils python3-yaml
-        tar_url="https://github.com/rhysd/actionlint/releases/download/v${{ inputs.actionlint-version }}/actionlint_${{ inputs.actionlint-version }}_linux_amd64.tar.gz"
+        tar_url="https://github.com/rhysd/actionlint/releases/download/v${version}/actionlint_${version}_linux_amd64.tar.gz"
         curl --proto '=https' --proto-redir =https -fsSL -o "$RUNNER_TEMP/actionlint.tar.gz" "$tar_url"
-        case "${{ inputs.actionlint-version }}" in
+        case "$version" in
           "1.7.12")
             expected="8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
             ;;
           *)
-            curl --proto '=https' --proto-redir =https -fsSL -o "$RUNNER_TEMP/checksums.txt" "https://github.com/rhysd/actionlint/releases/download/v${{ inputs.actionlint-version }}/actionlint_${{ inputs.actionlint-version }}_checksums.txt"
-            expected=$(grep -E "actionlint_${{ inputs.actionlint-version }}_linux_amd64\.tar\.gz" "$RUNNER_TEMP/checksums.txt" | awk '{print $1}')
+            curl --proto '=https' --proto-redir =https -fsSL -o "$RUNNER_TEMP/checksums.txt" "https://github.com/rhysd/actionlint/releases/download/v${version}/actionlint_${version}_checksums.txt"
+            expected=$(grep -E "actionlint_${version}_linux_amd64\.tar\.gz" "$RUNNER_TEMP/checksums.txt" | awk '{print $1}')
             ;;
         esac
         echo "$expected  $RUNNER_TEMP/actionlint.tar.gz" | sha256sum -c -