diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000..2aa40c805
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,13 @@
+# actionlint configuration
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+self-hosted-runner:
+  labels: []
+
+# ShellCheck rules suppressed across all run: blocks.
+ignore:
+  - 'shellcheck reported issue in this script: SC1091:.+'  # Can't follow non-constant source
+  - 'shellcheck reported issue in this script: SC2006:.+'  # Use $(...) instead of backticks
+  - 'shellcheck reported issue in this script: SC2046:.+'  # Quote to prevent word splitting
+  - 'shellcheck reported issue in this script: SC2086:.+'  # Double-quote to prevent globbing/word splitting
+  - 'shellcheck reported issue in this script: SC2129:.+'  # Consider using { cmd1; cmd2; } >> file
+  - 'shellcheck reported issue in this script: SC2155:.+'  # Declare and assign separately to avoid masking return values
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 000000000..6b7a282a2
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,34 @@
+name: Actionlint
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actionlint.yaml'
+      - '.github/actionlint.yml'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actionlint.yaml'
+      - '.github/actionlint.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: actionlint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Download actionlint
+        id: download
+        run: bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        shell: bash
+      - name: Run actionlint
+        run: |
+          ./actionlint -color
+        shell: bash
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5e60406e7..483c00f92 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -80,7 +80,7 @@ jobs:
         df -h /
     - name: Chown user
       run: |
-        sudo chown -R $USER:$USER $GITHUB_WORKSPACE
+        sudo chown -R "$USER":"$USER" "$GITHUB_WORKSPACE"
     - uses: actions/checkout@master
     - uses: actions/setup-python@v5
       name: Setup Python ${{ matrix.python-version }}
@@ -129,7 +129,7 @@ jobs:
         pip3 install -r requirements-django.txt
         pip3 install -r requirements-pubsub.txt
         pip3 install .
-        pip3 install GDAL==`gdal-config --version`
+        pip3 install GDAL=="$(gdal-config --version)"
     - name: setup test data ⚙️
       run: |
         pybabel compile -d locale -l es