diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 60344cf60c1d5..320c913b6e801 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,7 +37,7 @@ jobs:
         run: |
           TAGS="bindata sqlite sqlite_unlock_notify pam" make build
           mkdir -p dist/release
-          cp -p gitea dist/release/gitea-$(git describe --tags --always)-linux-amd64
+          cp -p gitea dist/release/gitea-"$(git describe --tags --always)"-linux-amd64
 
       - name: Compress Release Assets
         run: |
@@ -47,7 +47,7 @@ jobs:
         # each release asset in the official build process gets a separate .sha256 file
         # which means we need a loop to emulate it
         run: |
-          (cd dist/release; for asset in *; do sha256sum $asset > $asset.sha256; done)
+          (cd dist/release; for asset in *; do sha256sum "$asset" > "$asset".sha256; done)
 
       - name: Upload Release
         # this Action creates the release if not yet created