diff --git a/.gitea/workflows/kibot.yml b/.gitea/workflows/kibot.yml
index 49656a7..c13f3b8 100644
--- a/.gitea/workflows/kibot.yml
+++ b/.gitea/workflows/kibot.yml
@@ -63,16 +63,24 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - id: derive
+        env:
+          # Inject via env so commit-message / PR-title backticks or
+          # other shell metacharacters don't trigger command substitution
+          # when bash evaluates the script. Direct ${{ … }} interpolation
+          # into the run: body would splice the raw text into bash —
+          # backticks become $(…). Keep this env-var indirection.
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          GIT_SHA: ${{ github.sha }}
         run: |
           # Dev branch: VERSION=dev. Main branch: parse VX.Y from commit
           # message (matches the GitLab-side rule). MR-to-main uses the
           # MR title's V-token, falling back to dev.
           if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            MSG="${{ github.event.head_commit.message }}"
-            VERSION=$(echo "$MSG" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
-            [ -z "$VERSION" ] && VERSION="${{ github.sha }}" && VERSION="${VERSION:0:8}"
+            VERSION=$(printf '%s' "$COMMIT_MESSAGE" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
+            [ -z "$VERSION" ] && VERSION="${GIT_SHA:0:8}"
           elif [ "${{ github.event_name }}" = "pull_request" ]; then
-            VERSION=$(echo "${{ github.event.pull_request.title }}" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
+            VERSION=$(printf '%s' "$PR_TITLE" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
             [ -z "$VERSION" ] && VERSION="dev"
           else
             VERSION="dev"