diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 55c0b38..1852ba1 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -36,6 +36,9 @@ jobs:
           fetch-depth: 0
 
       - name: Run Semgrep
+        env:
+          EXTRA_CONFIGS: ${{ inputs.extra-configs }}
+          BASELINE_COMMIT: ${{ github.event.pull_request.base.sha }}
         run: |
           # Replaces the registry's github-actions-mutable-action-tag rule, which only accepts
           # commit SHAs. Workflows lock action commits in actions.lock, so an exact vX.Y.Z tag
@@ -72,6 +75,9 @@ jobs:
                       - pattern-not-regex: '@[0-9a-f]{40}(\s|$)'
                       - pattern-not-regex: '@v[0-9]+\.[0-9]+\.[0-9]+(\s|$)'
           RULE
+          # EXTRA_CONFIGS is a space-separated list of flags, so it is split on purpose.
+          set -f
+          # shellcheck disable=SC2086
           semgrep scan \
             --config p/security-audit \
             --config p/owasp-top-ten \
@@ -79,9 +85,9 @@ jobs:
             --config p/github-actions \
             --config "$RUNNER_TEMP/github-actions-mutable-action-tag.yml" \
             --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag \
-            ${{ inputs.extra-configs }} \
+            $EXTRA_CONFIGS \
             --severity ERROR --severity WARNING \
-            --baseline-commit ${{ github.event.pull_request.base.sha }} \
+            --baseline-commit "$BASELINE_COMMIT" \
             --json \
             -o semgrep-results.json || true
 
diff --git a/scripts/__pycache__/semgrep_triage.cpython-314.pyc b/scripts/__pycache__/semgrep_triage.cpython-314.pyc
new file mode 100644
index 0000000..5ae03e1
Binary files /dev/null and b/scripts/__pycache__/semgrep_triage.cpython-314.pyc differ
diff --git a/scripts/__pycache__/test_semgrep_triage.cpython-314.pyc b/scripts/__pycache__/test_semgrep_triage.cpython-314.pyc
new file mode 100644
index 0000000..ce9ba6d
Binary files /dev/null and b/scripts/__pycache__/test_semgrep_triage.cpython-314.pyc differ
diff --git a/scripts/test_semgrep_triage.py b/scripts/test_semgrep_triage.py
index 3e2420a..7d1d9bd 100644
--- a/scripts/test_semgrep_triage.py
+++ b/scripts/test_semgrep_triage.py
@@ -314,6 +314,14 @@ def test_allows_exact_tags_shas_and_same_repo_actions(self):
         ):
             self.assertFalse(self.flagged(uses), uses)
 
+    def test_inputs_reach_the_shell_through_env(self):
+        steps = yaml.safe_load(WORKFLOW.read_text())["jobs"]["scan"]["steps"]
+        step = next(s for s in steps if s.get("name") == "Run Semgrep")
+        self.assertNotIn("${{", self.script)
+        self.assertEqual(step["env"]["EXTRA_CONFIGS"], "${{ inputs.extra-configs }}")
+        self.assertIn("$EXTRA_CONFIGS \\\n", self.script)
+        self.assertIn('--baseline-commit "$BASELINE_COMMIT"', self.script)
+
     def test_flags_floating_tags_and_branches(self):
         for uses in ("actions/checkout@v4", "actions/checkout@v4.4", "actions/checkout@main", "actions/setup-node@v4.4.0-beta.1"):
             self.assertTrue(self.flagged(uses), uses)