diff --git a/.github/workflows/actions-security.yml b/.github/workflows/actions-security.yml
index 59addac..43cbf29 100644
--- a/.github/workflows/actions-security.yml
+++ b/.github/workflows/actions-security.yml
@@ -27,14 +27,22 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.
+      - name: actionlint handwritten workflows
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
         with:
-          # release.yml is generated by cargo-dist. Keep actionlint enabled for it,
-          # but ignore generated ShellCheck style/info noise from that file only.
-          flags: >-
-            -ignore \.github/workflows/release\.yml:[0-9]+:[0-9]+:.*SC2086
-            -ignore \.github/workflows/release\.yml:[0-9]+:[0-9]+:.*SC2129
+          files: >-
+            .github/workflows/actions-security.yml,
+            .github/workflows/ci.yml,
+            .github/workflows/osv-scanner.yml,
+            .github/workflows/rust-clippy.yml,
+            .github/workflows/semver.yml,
+            .github/workflows/supply-chain.yml
+
+      - name: actionlint generated release workflow
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
+        with:
+          files: .github/workflows/release.yml
+          shellcheck: false
   zizmor:
     name: zizmor
     runs-on: ubuntu-latest
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 5f4eb2d..da9b1a7 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -60,11 +60,19 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
+      - name: actionlint handwritten workflows
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
         with:
-          # release.yml is generated by cargo-dist. Keep actionlint enabled for it,
-          # but ignore generated ShellCheck style/info noise from that file only.
-          flags: >-
-            -ignore \.github/workflows/release\.yml:[0-9]+:[0-9]+:.*SC2086
-            -ignore \.github/workflows/release\.yml:[0-9]+:[0-9]+:.*SC2129
+          files: >-
+            .github/workflows/actions-security.yml,
+            .github/workflows/ci.yml,
+            .github/workflows/osv-scanner.yml,
+            .github/workflows/rust-clippy.yml,
+            .github/workflows/semver.yml,
+            .github/workflows/supply-chain.yml
+
+      - name: actionlint generated release workflow
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
+        with:
+          files: .github/workflows/release.yml
+          shellcheck: false