diff --git a/.github/workflows/check-file-contents.yml b/.github/workflows/check-file-contents.yml
index 7670733e97..8e506d923f 100644
--- a/.github/workflows/check-file-contents.yml
+++ b/.github/workflows/check-file-contents.yml
@@ -30,8 +30,8 @@ jobs:
 
       - name: Check for logger pattern in all changed Python files
         run: |
-          git fetch origin ${{ github.base_ref }}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.py$' || true)
+          git fetch origin ${GITHUB_BASE_REF}
+          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
           if [ -n "$CHANGED_FILES" ]; then
             echo "Changed Python files to check:"
             echo "$CHANGED_FILES"
@@ -61,8 +61,8 @@ jobs:
 
       - name: Check for import pattern in certain changed Python files
         run: |
-          git fetch origin ${{ github.base_ref }}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.py$' | grep -v -E '__init__.py$|version.py$|tests/.*|contributing/samples/' || true)
+          git fetch origin ${GITHUB_BASE_REF}
+          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E '__init__.py$|version.py$|tests/.*|contributing/samples/' || true)
           if [ -n "$CHANGED_FILES" ]; then
             echo "Changed Python files to check:"
             echo "$CHANGED_FILES"
@@ -88,8 +88,8 @@ jobs:
 
       - name: Check for import from cli package in certain changed Python files
         run: |
-          git fetch origin ${{ github.base_ref }}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.py$' | grep -v -E 'cli/.*|src/google/adk/tools/apihub_tool/apihub_toolset.py|tests/.*|contributing/samples/' || true)
+          git fetch origin ${GITHUB_BASE_REF}
+          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E 'cli/.*|src/google/adk/tools/apihub_tool/apihub_toolset.py|tests/.*|contributing/samples/' || true)
           if [ -n "$CHANGED_FILES" ]; then
             echo "Changed Python files to check:"
             echo "$CHANGED_FILES"
@@ -110,4 +110,4 @@ jobs:
             fi
           else
             echo "✅ No relevant Python files found."
-          fi
\ No newline at end of file
+          fi
diff --git a/.github/workflows/isort.yml b/.github/workflows/isort.yml
index 49536911b7..840d4ea8a7 100644
--- a/.github/workflows/isort.yml
+++ b/.github/workflows/isort.yml
@@ -42,8 +42,8 @@ jobs:
       - name: Run isort on changed files
         id: run_isort
         run: |
-          git fetch origin ${{ github.base_ref }}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.py$' || true)
+          git fetch origin ${GITHUB_BASE_REF}
+          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
           if [ -n "$CHANGED_FILES" ]; then
             echo "Changed Python files:"
             echo "$CHANGED_FILES"
diff --git a/.github/workflows/pyink.yml b/.github/workflows/pyink.yml
index d2eac1da74..a2d9e6d7c1 100644
--- a/.github/workflows/pyink.yml
+++ b/.github/workflows/pyink.yml
@@ -42,8 +42,8 @@ jobs:
       - name: Run pyink on changed files
         id: run_pyink
         run: |
-          git fetch origin ${{ github.base_ref }}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.py$' || true)
+          git fetch origin ${GITHUB_BASE_REF}
+          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
           if [ -n "$CHANGED_FILES" ]; then
             echo "Changed Python files:"
             echo "$CHANGED_FILES"
diff --git a/.github/workflows/release-cherry-pick.yml b/.github/workflows/release-cherry-pick.yml
index fd25f734e8..13d0a5b13f 100644
--- a/.github/workflows/release-cherry-pick.yml
+++ b/.github/workflows/release-cherry-pick.yml
@@ -30,8 +30,10 @@ jobs:
 
       - name: Cherry-pick commit
         run: |
-          echo "Cherry-picking ${{ inputs.commit_sha }} to release/candidate"
-          git cherry-pick ${{ inputs.commit_sha }}
+          echo "Cherry-picking ${INPUTS_COMMIT_SHA} to release/candidate"
+          git cherry-pick ${INPUTS_COMMIT_SHA}
+        env:
+          INPUTS_COMMIT_SHA: ${{ inputs.commit_sha }}
 
       - name: Push changes
         run: |
diff --git a/.github/workflows/release-finalize.yml b/.github/workflows/release-finalize.yml
index 9864aaab78..cc92b2ca08 100644
--- a/.github/workflows/release-finalize.yml
+++ b/.github/workflows/release-finalize.yml
@@ -45,9 +45,11 @@ jobs:
       - name: Create release branch
         if: steps.check.outputs.is_release_pr == 'true'
         run: |
-          git checkout -b "release/v${{ steps.version.outputs.version }}"
-          git push origin "release/v${{ steps.version.outputs.version }}"
-          echo "Created branch: release/v${{ steps.version.outputs.version }}"
+          git checkout -b "release/v${STEPS_VERSION_OUTPUTS_VERSION}"
+          git push origin "release/v${STEPS_VERSION_OUTPUTS_VERSION}"
+          echo "Created branch: release/v${STEPS_VERSION_OUTPUTS_VERSION}"
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
 
       - name: Delete release/candidate branch
         if: steps.check.outputs.is_release_pr == 'true'
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 51623d57d5..9732b6dde2 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Validate branch
         run: |
-          if [[ ! "${{ github.ref_name }}" =~ ^release/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if [[ ! "${GITHUB_REF_NAME}" =~ ^release/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "Error: Must run from a release/v* branch (e.g., release/v0.3.0)"
             exit 1
           fi
@@ -23,7 +23,7 @@ jobs:
       - name: Extract version
         id: version
         run: |
-          VERSION="${{ github.ref_name }}"
+          VERSION="${GITHUB_REF_NAME}"
           VERSION="${VERSION#release/v}"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Publishing version: $VERSION"
@@ -51,9 +51,10 @@ jobs:
       - name: Create merge-back PR
         env:
           GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
         run: |
           gh pr create \
             --base main \
-            --head "${{ github.ref_name }}" \
-            --title "chore: merge release v${{ steps.version.outputs.version }} to main" \
-            --body "Syncs version bump and CHANGELOG from release v${{ steps.version.outputs.version }} to main."
+            --head "${GITHUB_REF_NAME}" \
+            --title "chore: merge release v${STEPS_VERSION_OUTPUTS_VERSION} to main" \
+            --body "Syncs version bump and CHANGELOG from release v${STEPS_VERSION_OUTPUTS_VERSION} to main."