diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7490630..4952306 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -53,7 +53,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
-        with: { components: clippy, rustfmt }
+        with: { components: "clippy, rustfmt" }
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: ./scripts/ci-local.sh quick
 
@@ -66,7 +66,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
-        with: { components: clippy, rustfmt }
+        with: { components: "clippy, rustfmt" }
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       # CI runs the test suite under cargo-nextest; nextest does not run doctests,
       # which the dedicated `doctests` job covers.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1a647f2..140e299 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -277,7 +277,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
-        with: { components: clippy, rustfmt }
+        with: { components: "clippy, rustfmt" }
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
         with: { tool: nextest@0.9.143 }
@@ -518,6 +518,10 @@ jobs:
       attestations: write # write the image build-provenance attestation
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # Both download-artifact steps in this workflow log two warnings per run: v8 also
+      # writes an "artifact metadata storage record", which wants `artifact-metadata: write`.
+      # That permission is deliberately not granted and the record is not used — provenance
+      # here comes from the attestation below. The download itself is unaffected.
       - name: Download the released x86_64 gnu (glibc) service binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with: