diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 0000000..e6bb7e3
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,23 @@
+name: Actionlint
+# https://github.com/rhysd/actionlint
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+permissions: {}
+
+jobs:
+  actionlint:
+    name: Action lint
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Check workflow files
+        run: |
+          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+          ./actionlint -color -ignore SC2129
+        shell: bash
diff --git a/.github/workflows/build_and_deploy.yml b/.github/workflows/build_and_deploy.yml
index 9e25d4d..92ce525 100644
--- a/.github/workflows/build_and_deploy.yml
+++ b/.github/workflows/build_and_deploy.yml
@@ -13,7 +13,6 @@ on:
       target_directory:
         description: 'The directory to deploy the docs to'
         required: true
-        default: 'dev'
         type: string
       napari_ref:
         description: 'The napari/napari ref to build the docs against'
diff --git a/.github/workflows/remove_ready_to_merge.yml b/.github/workflows/remove_ready_to_merge.yml
index 11fa8ef..5ed717e 100644
--- a/.github/workflows/remove_ready_to_merge.yml
+++ b/.github/workflows/remove_ready_to_merge.yml
@@ -7,6 +7,7 @@ on:
         description: 'The name of the label to remove from closed items'
         required: false
         default: 'ready to merge'
+        type: string
 
 permissions:
   pull-requests: write
diff --git a/.github/workflows/upload_coverage.yml b/.github/workflows/upload_coverage.yml
index 5d29879..3bffad8 100644
--- a/.github/workflows/upload_coverage.yml
+++ b/.github/workflows/upload_coverage.yml
@@ -58,12 +58,12 @@ jobs:
           # if src exists, add it to the pathmap
           if [ -d "src" ]; then
             echo "    src/" >> ci_coveragerc
-            echo "    D:\\a\\$REPO_NAME\\$REPO_NAME\\src" >> ci_coveragerc
+            printf '%s\n' "    D:\\a\\$REPO_NAME\\$REPO_NAME\\src" >> ci_coveragerc
             echo "    /home/runner/work/$REPO_NAME/$REPO_NAME/src" >> ci_coveragerc
             echo "    /Users/runner/work/$REPO_NAME/$REPO_NAME/src" >> ci_coveragerc
           else
             echo "    ${GITHUB_WORKSPACE}" >> ci_coveragerc
-            echo "    D:\\a\\$REPO_NAME\\$REPO_NAME" >> ci_coveragerc
+            printf '%s\n' "    D:\\a\\$REPO_NAME\\$REPO_NAME" >> ci_coveragerc
             echo "    /home/runner/work/$REPO_NAME/$REPO_NAME" >> ci_coveragerc
             echo "    /Users/runner/work/$REPO_NAME/$REPO_NAME" >> ci_coveragerc
           fi
@@ -72,7 +72,7 @@ jobs:
           python -Im coverage combine --rcfile=ci_coveragerc covreports
           python -Im coverage xml -o coverage.xml
           python -Im coverage report
-          python -Im coverage report --format=markdown --skip-empty --skip-covered >> $GITHUB_STEP_SUMMARY
+          python -Im coverage report --format=markdown --skip-empty --skip-covered >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload to codecov
         uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1