diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml
index 6833590..5446f22 100644
--- a/.github/workflows/apply.yml
+++ b/.github/workflows/apply.yml
@@ -65,6 +65,13 @@ on:
       kosli_github_token:
         description: "GitHub token used by `kosli attest pr github` to look up pull requests. Optional; when omitted the pull-request attestation step is skipped. Cannot be named `github_token` because that name is reserved by `workflow_call`."
         required: false
+    outputs:
+      kosli_flow:
+        description: "The Kosli flow name used for attestations."
+        value: ${{ jobs.apply.outputs.kosli_flow }}
+      kosli_trail:
+        description: "The Kosli trail name used for attestations."
+        value: ${{ jobs.apply.outputs.kosli_trail }}
 
 jobs:
   apply:
@@ -103,8 +110,8 @@ jobs:
       KOSLI_ORG: ${{ inputs.kosli_org }}
       KOSLI_HOST: ${{ inputs.kosli_host }}
       KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
-      KOSLI_FLOW: terraform-apply-${{ inputs.environment }}-${{ github.event.repository.name }}
-      KOSLI_TRAIL: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}
+      KOSLI_FLOW: ${{ needs.apply.outputs.kosli_flow }}
+      KOSLI_TRAIL: ${{ needs.apply.outputs.kosli_trail }}
       COMMIT_ARG: ${{ inputs.pass_commit_to_kosli_commands && format('--commit {0}', inputs.ref) || '' }}
       GH_TOKEN: ${{ secrets.kosli_github_token }}
     steps:
@@ -158,15 +165,20 @@ jobs:
 
       - name: Kosli attest state file
         if: inputs.kosli_template_file != ''
-        run: kosli attest artifact "/tmp/${{ inputs.tf_state_file_name }}" --artifact-type file --name terraform-state $COMMIT_ARG
+        run: |
+          # shellcheck disable=SC2086
+          kosli attest artifact "/tmp/${{ inputs.tf_state_file_name }}" --artifact-type file --name terraform-state $COMMIT_ARG
 
       - name: Kosli attest drift plan
         if: inputs.kosli_template_file != ''
-        run: kosli attest artifact /tmp/drift.plan.json --artifact-type file --name drift-plan $COMMIT_ARG
+        run: |
+          # shellcheck disable=SC2086
+          kosli attest artifact /tmp/drift.plan.json --artifact-type file --name drift-plan $COMMIT_ARG
 
       - name: Kosli attest pull request
         if: inputs.kosli_template_file != '' && env.GH_TOKEN != ''
         run: |
+          # shellcheck disable=SC2086
           kosli attest pr github \
             --name pull-request \
             --github-token "$GH_TOKEN" \
diff --git a/.github/workflows/base.yml b/.github/workflows/base.yml
index 37cfc6f..72c7e44 100644
--- a/.github/workflows/base.yml
+++ b/.github/workflows/base.yml
@@ -64,6 +64,12 @@ on:
       has_changes:
         description: "true if the plan contains changes, false if no changes"
         value: ${{ jobs.terraform.outputs.has_changes }}
+      kosli_flow:
+        description: "The Kosli flow name used for attestations."
+        value: ${{ jobs.terraform.outputs.kosli_flow }}
+      kosli_trail:
+        description: "The Kosli trail name used for attestations."
+        value: ${{ jobs.terraform.outputs.kosli_trail }}
 
 jobs:
   terraform:
@@ -82,12 +88,22 @@ jobs:
       contents: write
     outputs:
       has_changes: ${{ steps.plan-summary.outputs.has_changes }}
+      kosli_flow: ${{ steps.kosli-outputs.outputs.kosli_flow }}
+      kosli_trail: ${{ steps.kosli-outputs.outputs.kosli_trail }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ inputs.github_repository_to_checkout }}
           ref: ${{ inputs.ref }}
 
+      - name: Export Kosli outputs
+        id: kosli-outputs
+        run: |
+          {
+            echo "kosli_flow=$KOSLI_FLOW"
+            echo "kosli_trail=$KOSLI_TRAIL"
+          } >> "$GITHUB_OUTPUT"
+
       - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
         with:
           terraform_version: ${{ inputs.tf_version }}
@@ -159,11 +175,15 @@ jobs:
 
       - name: Kosli begin trail
         if: inputs.kosli_template_file != ''
-        run: kosli begin trail "$KOSLI_TRAIL" --template-file "${{ inputs.kosli_template_file }}" $COMMIT_ARG
+        run: |
+          # shellcheck disable=SC2086
+          kosli begin trail "$KOSLI_TRAIL" --template-file "${{ inputs.kosli_template_file }}" $COMMIT_ARG
 
       - name: Kosli attest plan
         if: inputs.kosli_template_file != ''
-        run: kosli attest generic --name terraform-plan --attachments /tmp/${{ inputs.environment }}.plan.txt $COMMIT_ARG
+        run: |
+          # shellcheck disable=SC2086
+          kosli attest generic --name terraform-plan --attachments /tmp/${{ inputs.environment }}.plan.txt $COMMIT_ARG
 
       - name: Apply
         if: inputs.tf_apply
@@ -189,4 +209,6 @@ jobs:
 
       - name: Kosli attest apply
         if: inputs.tf_apply && inputs.kosli_template_file != ''
-        run: kosli attest generic --name terraform-apply --attachments /tmp/${{ inputs.environment }}.apply.txt $COMMIT_ARG
+        run: |
+          # shellcheck disable=SC2086
+          kosli attest generic --name terraform-apply --attachments /tmp/${{ inputs.environment }}.apply.txt $COMMIT_ARG
diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index a832540..32f9a38 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -50,6 +50,13 @@ on:
       kosli_api_token:
         description: "Kosli API token. Required when kosli_template_file is set."
         required: false
+    outputs:
+      kosli_flow:
+        description: "The Kosli flow name used for attestations."
+        value: ${{ jobs.plan.outputs.kosli_flow }}
+      kosli_trail:
+        description: "The Kosli trail name used for attestations."
+        value: ${{ jobs.plan.outputs.kosli_trail }}
 
 jobs:
   plan: