diff --git a/.github/workflows/reusable-pr-security-review.yml b/.github/workflows/reusable-pr-security-review.yml
index f08df21..23d92b5 100644
--- a/.github/workflows/reusable-pr-security-review.yml
+++ b/.github/workflows/reusable-pr-security-review.yml
@@ -86,11 +86,15 @@ jobs:
       - name: Resolve subject
         id: subject
         if: github.event_name == 'pull_request_target'
+        env:
+          EVENT_ACTION: ${{ github.event.action }}
+          SENDER_LOGIN: ${{ github.event.sender.login }}
+          PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
         run: |
-          if [ "${{ github.event.action }}" = "labeled" ]; then
-            echo "login=${{ github.event.sender.login }}" >> "$GITHUB_OUTPUT"
+          if [ "$EVENT_ACTION" = "labeled" ]; then
+            echo "login=$SENDER_LOGIN" >> "$GITHUB_OUTPUT"
           else
-            echo "login=${{ github.event.pull_request.user.login }}" >> "$GITHUB_OUTPUT"
+            echo "login=$PR_AUTHOR_LOGIN" >> "$GITHUB_OUTPUT"
           fi
       # Authorized = member of the org team OR a write/admin collaborator (team tier first).
       - name: Check authorization
diff --git a/.github/workflows/reusable-strands-command.yml b/.github/workflows/reusable-strands-command.yml
index 5df208f..39f0c45 100644
--- a/.github/workflows/reusable-strands-command.yml
+++ b/.github/workflows/reusable-strands-command.yml
@@ -88,8 +88,10 @@ jobs:
           required-permission: write
       - name: Enforce authorization
         if: github.event_name != 'workflow_dispatch' && steps.authz.outputs.is-authorized != 'true'
+        env:
+          COMMENT_USER: ${{ github.event.comment.user.login }}
         run: |
-          echo "❌ User ${{ github.event.comment.user.login }} does not have write access"
+          echo "❌ User $COMMENT_USER does not have write access"
           exit 1
 
       - name: Checkout