diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 93aba2d..92d7000 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install cloc
         run: |
@@ -33,6 +35,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install poetry
         run: pipx install poetry
@@ -64,8 +68,8 @@ jobs:
         run: |
           mkdir package/bin
           cp -R src/* package/bin/
-          export APP_VERSION=$(poetry version | awk -F ' ' '{print $2}')
-          poetry run ucc-gen build --ta-version ${APP_VERSION}
+          APP_VERSION=$(poetry version | awk -F ' ' '{print $2}')
+          poetry run ucc-gen build --ta-version "${APP_VERSION}"
           # cleanup python files
           rm -rf output/bitwarden_event_logs/{bin,lib}/__pycache__
           rm -rf output/bitwarden_event_logs/bin/{bitwarden_event_logs_rh_settings.py,import_declare_test.py}