diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000000..eecb88a033
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,4 @@
+paths:
+  .github/workflows/*.lock.yml:
+    ignore:
+      - ".+"
diff --git a/.github/matchers/actionlint.json b/.github/matchers/actionlint.json
new file mode 100644
index 0000000000..4613e1617b
--- /dev/null
+++ b/.github/matchers/actionlint.json
@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 0000000000..1bd951bbdf
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,35 @@
+name: Actionlint
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/**
+  pull_request:
+    paths:
+      - .github/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            .github
+
+      # Content copied from https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/.github/actionlint-matcher.json
+      - name: Add ActionLint Problem Matcher
+        run: echo "::add-matcher::.github/matchers/actionlint.json"
+
+      - name: Lint workflows
+        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color -verbose
diff --git a/.github/workflows/event-processor.yml b/.github/workflows/event-processor.yml
index ad549de54c..762558e070 100644
--- a/.github/workflows/event-processor.yml
+++ b/.github/workflows/event-processor.yml
@@ -35,7 +35,7 @@ jobs:
         uses: azure/login@v3
         if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }}
         with:
-            client-id: a6dd2dfe-7352-41a7-9020-05301c3bca1a
+            client-id: e4cb9fd5-0875-4ca1-bc43-56196f5dfb8f
             tenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
             allow-no-subscriptions: true
 
@@ -49,7 +49,7 @@ jobs:
             --query value)
 
           echo "::add-mask::$LABEL_SERVICE_API_KEY"
-          echo "LABEL_SERVICE_API_KEY=$LABEL_SERVICE_API_KEY" >> $GITHUB_ENV
+          echo "LABEL_SERVICE_API_KEY=$LABEL_SERVICE_API_KEY" >> "$GITHUB_ENV"
 
           APP_CONFIG_ENDPOINT=$(az keyvault secret show \
             --vault-name issue-labeler \
@@ -58,7 +58,7 @@ jobs:
             --query value)
 
           echo "::add-mask::$APP_CONFIG_ENDPOINT"
-          echo "APP_CONFIG_ENDPOINT=$APP_CONFIG_ENDPOINT" >> $GITHUB_ENV
+          echo "APP_CONFIG_ENDPOINT=$APP_CONFIG_ENDPOINT" >> "$GITHUB_ENV"
 
       # To run github-event-processor built from source, for testing purposes, uncomment everything
       # in between the Start/End-Build From Source comments and comment everything in between the