diff --git a/.github/actions/contract/action.yml b/.github/actions/contract/action.yml
index f447fba..71e26a2 100644
--- a/.github/actions/contract/action.yml
+++ b/.github/actions/contract/action.yml
@@ -33,13 +33,19 @@ runs:
         TARGET: ${{ inputs.target }}
         OUTPUT: ${{ inputs.output }}
         AT: ${{ inputs.at }}
+        # Passed through the environment like every other value here.
+        # A ${{ }} expression interpolated straight into the script is the
+        # shape actions/code-injection flags, and this file already avoids
+        # it everywhere else; the runner sets this one, but the rule is
+        # about the shape, and one exception is what makes a habit unreliable.
+        ACTION_PATH: ${{ github.action_path }}
       run: |
         set -euo pipefail
         valid_path() {
           [[ "$1" =~ ^[A-Za-z0-9._/-]+$ && "$1" != /* && "$1" != *..* ]]
         }
         valid_path "$PLAN"
-        root="$(cd -- "${{ github.action_path }}/../../.." && pwd)"
+        root="$(cd -- "$ACTION_PATH/../../.." && pwd)"
         case "$COMMAND" in
           seal)
             valid_path "$OUTPUT"
diff --git a/.github/actions/lifecycle/action.yml b/.github/actions/lifecycle/action.yml
index 91d2f2e..d1c154f 100644
--- a/.github/actions/lifecycle/action.yml
+++ b/.github/actions/lifecycle/action.yml
@@ -33,6 +33,12 @@ runs:
         APPROVAL: ${{ inputs.approval }}
         STATE_OUTPUT: ${{ inputs.state_output }}
         EVIDENCE_OUTPUT: ${{ inputs.evidence_output }}
+        # Passed through the environment like every other value here.
+        # A ${{ }} expression interpolated straight into the script is the
+        # shape actions/code-injection flags, and this file already avoids
+        # it everywhere else; the runner sets this one, but the rule is
+        # about the shape, and one exception is what makes a habit unreliable.
+        ACTION_PATH: ${{ github.action_path }}
       run: |
         set -euo pipefail
         valid_path() {
@@ -43,7 +49,7 @@ runs:
         valid_path "$STATE_OUTPUT"
         valid_path "$EVIDENCE_OUTPUT"
         [[ "$OPERATION" =~ ^(apply|verify|resume|rollback)$ ]]
-        root="$(cd -- "${{ github.action_path }}/../../.." && pwd)"
+        root="$(cd -- "$ACTION_PATH/../../.." && pwd)"
         python3 "$root/scripts/cd_contract.py" validate-plan "$PLAN"
         python3 "$root/scripts/cd_contract.py" validate-state "$PLAN" "$STATE"
         adapter_args=("$OPERATION" --plan "$PLAN" --state "$STATE" --state-output "$STATE_OUTPUT" --evidence-output "$EVIDENCE_OUTPUT")