diff --git a/.github/workflows/homebrew-update.yml b/.github/workflows/homebrew-update.yml
index d2754972e0..2707ecf92d 100644
--- a/.github/workflows/homebrew-update.yml
+++ b/.github/workflows/homebrew-update.yml
@@ -9,13 +9,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create update issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ github.event.release.tag_name }}
+          RELEASE_URL: ${{ github.event.release.html_url }}
         run: |
-          curl -X POST \
-            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            https://api.github.com/repos/aws/homebrew-tap/issues \
-            -d '{
-              "title": "Update eksctl to ${{ github.event.release.tag_name }}",
-              "body": "New eksctl release ${{ github.event.release.tag_name }} is available.\n\nRelease URL: ${{ github.event.release.html_url }}",
-              "labels": ["eksctl-update"]
-            }'
\ No newline at end of file
+          jq -n \
+            --arg tag "$TAG_NAME" \
+            --arg url "$RELEASE_URL" \
+            '{
+              title: "Update eksctl to \($tag)",
+              body: "New eksctl release \($tag) is available.\n\nRelease URL: \($url)",
+              labels: ["eksctl-update"]
+            }' \
+          | curl -sSf -X POST \
+              -H "Authorization: token $GH_TOKEN" \
+              -H "Accept: application/vnd.github.v3+json" \
+              https://api.github.com/repos/aws/homebrew-tap/issues \
+              -d @-
\ No newline at end of file
diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml
index fcf834b77f..f6a8495c85 100644
--- a/.github/workflows/release-drafter.yaml
+++ b/.github/workflows/release-drafter.yaml
@@ -32,10 +32,16 @@ jobs:
           commitish: main
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          # The Upsert pull request step below authenticates with its own token,
+          # so there is no need to leave a credential behind in the git config.
+          persist-credentials: false
       - name: Copy release notes from Draft
+        env:
+          TAG_NAME: ${{ steps.draft.outputs.tag_name }}
+          RELEASE_BODY: ${{ steps.draft.outputs.body }}
         run: |
-          tag_name=${{ steps.draft.outputs.tag_name }}
-          echo "${{ steps.draft.outputs.body }}" > docs/release_notes/${tag_name:1}.md
+          printf '%s\n' "$RELEASE_BODY" > "docs/release_notes/${TAG_NAME#v}.md"
       - name: Upsert pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 #v8.1.1
         with: