diff --git a/actions/refs-not-closing/run.sh b/actions/refs-not-closing/run.sh
index d281ce6..6a0dd4a 100755
--- a/actions/refs-not-closing/run.sh
+++ b/actions/refs-not-closing/run.sh
@@ -12,6 +12,8 @@ name="${GITHUB_REPOSITORY#*/}"
   exit 1
 }
 
+# GraphQL variables are literal API syntax; the shell must not expand them.
+# shellcheck disable=SC2016
 facts="$(gh api graphql \
   -f query='query($owner: String!, $name: String!, $number: Int!) {
     repository(owner: $owner, name: $name) {
diff --git a/test/refs-not-closing.test.sh b/test/refs-not-closing.test.sh
index 60db210..b81a2dd 100755
--- a/test/refs-not-closing.test.sh
+++ b/test/refs-not-closing.test.sh
@@ -143,7 +143,7 @@ one_graphql_read() {
 check "action performs exactly one GraphQL read" 0 "1" \
   one_graphql_read
 check "composite delegates to the tested entrypoint" 0 "run.sh" \
-  grep -F 'run: bash "$GITHUB_ACTION_PATH/run.sh"' "$ACTION"
+  grep -F "run: bash \"\$GITHUB_ACTION_PATH/run.sh\"" "$ACTION"
 
 check "workflow wakes on body edits" 0 "types: [opened, edited, reopened, synchronize]" \
   grep -F "types: [opened, edited, reopened, synchronize]" "$WORKFLOW"