diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57c7450..9fc3b5d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -372,10 +372,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.AppImage \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # The .deb and .rpm are thin: they depend on the distro's Python, GTK,
@@ -424,10 +426,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.deb dist/*.rpm \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   build-native-arm64:
@@ -470,10 +474,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.deb dist/*.rpm \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # Pins match .github/workflows/flatpak.yml. These jobs start with the tag
@@ -783,12 +789,14 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           ls -la dist/*.flatpak
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.flatpak \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # Runs last because the aarch64 AppImage, both Flatpak bundles, the native
@@ -848,10 +856,12 @@ jobs:
       - name: Attach SHA256SUMS to the release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/SHA256SUMS \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   publish-pypi:
@@ -1078,11 +1088,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           ls -la dist/*.snap
           gh release upload "$TAG" dist/*.snap \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   publish-snap: