diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fd0a82649f0..73ca728ccdc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,8 +30,15 @@ jobs:
       - uses: actions/checkout@v4
       - name: Prerequisites
         run: |
+          prerequisites=(
+            ca-certificates
+            curl
+            gcc  # rustc calls gcc to invoke the linker.
+            libc-dev  # rustc, in the toolchain we are using, dynamically links to the system libc.
+          )
           apt-get update
-          apt-get install --no-install-recommends -y ca-certificates curl gcc libc-dev # gcc is required as OS abstraction
+          apt-get install --no-install-recommends -y -- "${prerequisites[@]}"
+        shell: bash
       - name: Verify environment is sufficiently minimal for the test
         run: |
           set -x
@@ -84,15 +91,14 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Setup dependencies (macos)
         if: startsWith(matrix.os, 'macos')
-        run:
-          brew install tree openssl gnu-sed
+        run: brew install tree openssl gnu-sed
       - name: "cargo check default features"
         if: startsWith(matrix.os, 'windows')
         run: cargo check --workspace --bins --examples
       - uses: taiki-e/install-action@v2
         with:
           tool: nextest
-      - name: "Test (nextest)"
+      - name: Test (nextest)
         env:
           GIX_TEST_CREATE_ARCHIVES_EVEN_ON_CI: '1'
         run: cargo nextest run --workspace --no-fail-fast
@@ -157,9 +163,9 @@ jobs:
       - uses: taiki-e/install-action@v2
         with:
           tool: cross
-      - name: "check"
+      - name: check
         run: cross check -p gix --target ${{ matrix.target }}
-      - name: "Test (unit)"
+      - name: Test (unit)
         # run high-level unit tests that exercise a lot of code while being pure Rust to ease building test binaries.
         # TODO: figure out why `git` doesn't pick up environment configuration so build scripts fail when using `-p gix`.
         run: cross test -p gix-hashtable --target ${{ matrix.target }}
@@ -275,7 +281,7 @@ jobs:
 
     defaults:
       run:
-        shell: bash
+        shell: bash  # Use bash even on Windows, if we ever reenable windows-latest for testing.
 
     steps:
       - uses: actions/checkout@v4
@@ -327,7 +333,7 @@ jobs:
       - name: Each job must block PRs or be declared not to
         run: |
           sort -m blocking-jobs.txt expected-nonblocking-jobs.txt |
-            diff --color=always -U1000 -- - all-jobs.txt
+            diff --color=always -U1000 - all-jobs.txt
 
   # Dummy job to have a stable name for the "all tests pass" requirement
   tests-pass:
@@ -349,7 +355,7 @@ jobs:
 
     steps:
       - name: Fail if ANY dependency has failed or cancelled
-        if: "contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')"
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
         run: exit 1
       - name: OK
         run: exit 0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 040022fb8d7..7323d36986e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read  # Set more permissively in jobs that need `write`.
+  contents: read  # This is set more permissively in jobs that need `write`.
 
 defaults:
   run: