diff --git a/.github/workflows/pin-requirements.yml b/.github/workflows/pin-requirements.yml
index bcea39d5..4a4f9031 100644
--- a/.github/workflows/pin-requirements.yml
+++ b/.github/workflows/pin-requirements.yml
@@ -31,18 +31,18 @@ jobs:
           ref: main
 
       - name: Get latest tag
-        run: echo "LATEST_TAG=$(git rev-list --tags --max-count=1 --abbrev-commit)" >> $GITHUB_ENV
+        run: echo "LATEST_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV"
 
       - name: Set SIGSTORE_RELEASE_TAG and SIGSTORE_NEW_BRANCH
         env:
           INPUT_TAG: "${{ inputs.tag }}"
         run: |
           if [ -n "${INPUT_TAG}" ]; then
-            echo "SIGSTORE_RELEASE_TAG=${INPUT_TAG}" >> $GITHUB_ENV
-            echo "SIGSTORE_NEW_BRANCH=pin-requirements/sigstore/${INPUT_TAG}" >> $GITHUB_ENV
+            echo "SIGSTORE_RELEASE_TAG=${INPUT_TAG}" >> "$GITHUB_ENV"
+            echo "SIGSTORE_NEW_BRANCH=pin-requirements/sigstore/${INPUT_TAG}" >> "$GITHUB_ENV"
           else
-            echo "SIGSTORE_RELEASE_TAG=${LATEST_TAG}" >> $GITHUB_ENV
-            echo "SIGSTORE_NEW_BRANCH=pin-requirements/sigstore/${LATEST_TAG}" >> $GITHUB_ENV
+            echo "SIGSTORE_RELEASE_TAG=${LATEST_TAG}" >> "$GITHUB_ENV"
+            echo "SIGSTORE_NEW_BRANCH=pin-requirements/sigstore/${LATEST_TAG}" >> "$GITHUB_ENV"
           fi
 
       - name: Configure git