diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94aad3938..8d2d43c82 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,8 +43,10 @@ jobs:
       if: ${{ inputs.plugins == '' }}
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        REPOSITORY: ${{ github.repository }}
+        REF_NAME: ${{ github.ref_name }}
       run: |
-        base_ref=$(gh api "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?branch=${{ github.ref_name }}&status=success&per_page=1" --jq '.workflow_runs[0].head_sha')
+        base_ref=$(gh api "repos/${REPOSITORY}/actions/workflows/ci.yml/runs?branch=${REF_NAME}&status=success&per_page=1" --jq '.workflow_runs[0].head_sha')
         val=$(go run ./internal/cmd/changed-plugins --base-ref "${base_ref}")
         if [[ -n "${val}" && -z "${PLUGINS}" ]]; then
           echo "PLUGINS=${val}" >> $GITHUB_ENV
diff --git a/.github/workflows/fetch_versions.yml b/.github/workflows/fetch_versions.yml
index 06cd61f36..fd6cb0f47 100644
--- a/.github/workflows/fetch_versions.yml
+++ b/.github/workflows/fetch_versions.yml
@@ -1,8 +1,5 @@
 name: Fetch latest versions
 
-# When triggering a manual execution of the workflow, you may want to disable the scheduled execution temporarily
-# to ensure that any in-flight generated PR is not overridden by the scheduled execution.
-
 on:
   schedule:
     # Run once a day at 10 AM EST
@@ -11,6 +8,10 @@ on:
 permissions:
   contents: read
   issues: write
+
+# Only allow a single fetch-versions workflow to run at a time so a manual run
+# and the scheduled run don't race on the fetch-versions PR branch.
+concurrency: ${{ github.workflow }}
 jobs:
   fetch-versions:
     if: github.repository == 'bufbuild/plugins'
@@ -88,7 +89,7 @@ jobs:
         if: ${{ failure() }}
         env:
           GITHUB_TOKEN: ${{ steps.generate_issues_token.outputs.token }}
-          GITHUB_SERVER_URL: ${ github.server_url }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_RUN_ID: ${{ github.run_id }}
           GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index f24f03d07..f4d2ed5b9 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -41,8 +41,10 @@ jobs:
         check-latest: true
     - name: Calculate changed plugins and set PLUGINS env var from base branch
       if: ${{ inputs.plugins == '' }}
+      env:
+        BASE_REF: ${{ github.base_ref }}
       run: |
-        val=`go run ./internal/cmd/changed-plugins --base-ref 'origin/${{ github.base_ref }}' --include-testdata`
+        val=$(go run ./internal/cmd/changed-plugins --base-ref "origin/${BASE_REF}" --include-testdata)
         if [[ -n "${val}" && -z "${PLUGINS}" ]]; then
           echo "PLUGINS=${val}" >> $GITHUB_ENV
         fi
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 233aafda1..4ab0978a9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,7 +67,7 @@ jobs:
         if: ${{ failure() }}
         env:
           GITHUB_TOKEN: ${{ steps.generate_issues_token.outputs.token }}
-          GITHUB_SERVER_URL: ${ github.server_url }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_RUN_ID: ${{ github.run_id }}
           GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
diff --git a/.github/workflows/restore-release.yml b/.github/workflows/restore-release.yml
index b2a92b64f..7947651de 100644
--- a/.github/workflows/restore-release.yml
+++ b/.github/workflows/restore-release.yml
@@ -37,5 +37,7 @@ jobs:
       - name: Restore Release
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          ARGUMENTS: ${{ inputs.arguments }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
-          go run ./internal/cmd/restore-release ${{ inputs.arguments }} ${{ inputs.release_tag }}
+          go run ./internal/cmd/restore-release ${ARGUMENTS} "${RELEASE_TAG}"
diff --git a/.github/workflows/upload.yml b/.github/workflows/upload.yml
index 243b15b00..100901d15 100644
--- a/.github/workflows/upload.yml
+++ b/.github/workflows/upload.yml
@@ -47,8 +47,9 @@ jobs:
       - name: Download Plugins
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          SINCE: ${{ inputs.since }}
         run: |
-          go run ./cmd/download-plugins -since ${{ inputs.since }} downloads
+          go run ./cmd/download-plugins -since "${SINCE}" downloads
       - name: Upload To Release Bucket
         run: gsutil -m rsync -r downloads gs://buf-plugins
       - name: Generate Github Token
@@ -63,7 +64,7 @@ jobs:
         if: ${{ failure() }}
         env:
           GITHUB_TOKEN: ${{ steps.generate_issues_token.outputs.token }}
-          GITHUB_SERVER_URL: ${ github.server_url }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_RUN_ID: ${{ github.run_id }}
           GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}