diff --git a/.github/workflows/actions-security.yml b/.github/workflows/actions-security.yml
index 91b1868..348a514 100644
--- a/.github/workflows/actions-security.yml
+++ b/.github/workflows/actions-security.yml
@@ -28,8 +28,13 @@ jobs:
           persist-credentials: false
 
       - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
-
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.
+        with:
+          # release.yml is generated by dist. Keep linting it for real
+          # workflow issues, but ignore generated ShellCheck style/info noise.
+          flags: >-
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2086'
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2129'
   zizmor:
     name: zizmor
     runs-on: ubuntu-latest
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 34316a0..192e695 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -62,3 +62,9 @@ jobs:
 
       - name: Run actionlint
         uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
+        with:
+          # release.yml is generated by dist. Keep linting it for real
+          # workflow issues, but ignore generated ShellCheck style/info noise.
+          flags: >-
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2086'
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2129'