diff --git a/.gitea/workflows/windows-build.yml b/.gitea/workflows/windows-build.yml
index eb0edf2..ec74ec9 100644
--- a/.gitea/workflows/windows-build.yml
+++ b/.gitea/workflows/windows-build.yml
@@ -13,13 +13,13 @@ jobs:
   build:
     runs-on: windows
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4 # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@stable # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
 
       - name: Install Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v4 # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
         with:
           node-version: 20
 
@@ -30,7 +30,7 @@ jobs:
         run: npm run app:build
 
       - name: Upload installer
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4 # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
         with:
           name: voiced-windows
           path: src-tauri/target/release/bundle/nsis/*.exe
diff --git a/scripts/templates/compare.mjs b/scripts/templates/compare.mjs
index 0b81303..899fde4 100644
--- a/scripts/templates/compare.mjs
+++ b/scripts/templates/compare.mjs
@@ -107,7 +107,7 @@ async function main() {
       invoice: { clientName: TOKEN, clientAddress: LONG, notes: `Note: ${TOKEN} ${LONG}` },
     });
     writeFileSync(path.join(OUT, `${id}-A4-longtext.png`), (await rasterize(long.result.bytes, 1, SCALE)).toBuffer("image/png"));
-    console.log(`${id}: pages ${withLogo.result.pages}/${sixty.result.pages}/${letter.result.pages}/${long.result.pages}; audit issues`, [withLogo, noLogo, sixty, letter, long].map((x) => x.result.issues.length).join("/"));
+    console.log("%s: pages %s/%s/%s/%s; audit issues %s", id, withLogo.result.pages, sixty.result.pages, letter.result.pages, long.result.pages, [withLogo, noLogo, sixty, letter, long].map((x) => x.result.issues.length).join("/"));
     for (const x of [withLogo, noLogo, sixty, letter, long]) for (const i of x.result.issues) console.log("   ", i.severity, i.code, `p${i.page}`, i.message.slice(0, 160));
   }
 }