diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index ea56f1367..0491abd68 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -77,7 +77,7 @@ jobs:
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           git merge-base --is-ancestor "$RELEASE_TAG" HEAD
           if [ -f scripts/release.py ]; then
             python3 scripts/release.py versions --tag "$RELEASE_TAG"
@@ -86,6 +86,8 @@ jobs:
             test "v$VERSION" = "$RELEASE_TAG"
           fi
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Build web bundle
         run: nix develop --command trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
@@ -97,26 +99,37 @@ jobs:
           path: website
 
       - name: Validate website
-        working-directory: website
-        run: nix develop --command python3 scripts/test_site.py
+        run: nix develop "$GITHUB_WORKSPACE/website" --command python3 "$GITHUB_WORKSPACE/website/scripts/test_site.py"
 
       - name: Assemble landing page
-        working-directory: website
-        run: nix develop --command sh scripts/assemble-site.sh "$GITHUB_WORKSPACE/dist"
+        run: |
+          SCRIPT=$(cat <<'EOF'
+          cd "$GITHUB_WORKSPACE/website"
+          sh "$GITHUB_WORKSPACE/website/scripts/assemble-site.sh" "$GITHUB_WORKSPACE/dist"
+          EOF
+          )
+          nix develop "$GITHUB_WORKSPACE/website" --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Record website source
-        working-directory: website
-        run: nix develop --command bash --noprofile --norc -euo pipefail -c 'git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"'
+        run: |
+          SCRIPT=$(cat <<'EOF'
+          cd "$GITHUB_WORKSPACE/website"
+          git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"
+          EOF
+          )
+          nix develop "$GITHUB_WORKSPACE/website" --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Record release version and source
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
           RELEASE_COMMIT: ${{ steps.source.outputs.commit }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           jq -n --arg version "${RELEASE_TAG#v}" --arg commit "$RELEASE_COMMIT" \
             '{version: $version, commit: $commit}' > dist/app/release.json
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # GitHub Pages runs Jekyll, which ignores files; opt out so the
       # wasm-bindgen output is served verbatim.
@@ -130,7 +143,7 @@ jobs:
         env:
           OCS_PATREON_TOKEN: ${{ secrets.OCS_PATREON_TOKEN }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           python3 - <<'PY'
           import json
           import os
@@ -241,6 +254,8 @@ jobs:
           print(f"supporters: {len(supporters)}")
           PY
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # Publish separate light/dark charts for stars and release downloads.
       - name: Generate project growth charts
@@ -254,7 +269,7 @@ jobs:
       # unavailable during deployment.
       - name: Generate videos.json
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           python3 - <<'PY'
           import json
           import re
@@ -313,13 +328,15 @@ jobs:
           print(f"videos: {len(json.loads(output.read_text(encoding='utf-8')))}")
           PY
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # Publish a public snapshot of GitHub discussions.
       - name: Generate discussions.json
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           QUERY='
             query($owner: String!, $name: String!) {
               repository(owner: $owner, name: $name) {
@@ -365,6 +382,8 @@ jobs:
             > dist/app/discussions.json
           echo "discussions: $(jq 'length' dist/app/discussions.json)"
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - uses: actions/upload-pages-artifact@v3
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f67d6679..8a61cd561 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Prepare AppDir
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           mkdir -p AppDir/usr/bin
           mkdir -p AppDir/usr/share/applications
           mkdir -p AppDir/usr/share/icons/hicolor/256x256/apps
@@ -68,6 +68,8 @@ jobs:
           rsvg-convert -w 256 -h 256 assets/logo.svg \
             -o AppDir/usr/share/icons/hicolor/256x256/apps/io.github.HakanSeven12.OpenCadStudio.png
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Pack shared Linux payload
         run: nix develop --command tar -C AppDir -czf linux-payload.tar.gz usr
@@ -82,16 +84,18 @@ jobs:
 
       - name: Download linuxdeploy
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           wget -q https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
           chmod +x linuxdeploy-x86_64.AppImage
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Build AppImage
         env:
           APPIMAGE_EXTRACT_AND_RUN: 1
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           ./linuxdeploy-x86_64.AppImage \
             --appdir AppDir \
             --desktop-file AppDir/usr/share/applications/io.github.HakanSeven12.OpenCadStudio.desktop \
@@ -99,17 +103,21 @@ jobs:
             --output appimage
           mv Open*CAD*Studio*.AppImage OpenCADStudio.AppImage
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Upload AppImage to release
         if: env.RELEASE_TAG != ''
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           ASSET=OpenCADStudio-${{ env.RELEASE_TAG }}-linux-x86_64.AppImage
           mv OpenCADStudio.AppImage "$ASSET"
           gh release upload ${{ env.RELEASE_TAG }} "$ASSET" --clobber --repo ${{ github.repository }}
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
   build-snap:
     needs: build-appimage
@@ -149,12 +157,14 @@ jobs:
       - name: Set package version
         id: package
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           VERSION=$(python3 scripts/release.py versions --tag "$RELEASE_TAG" | sed -n 's/^version=//p')
           test -n "$VERSION"
           sed -i "s/^version: .*/version: '$VERSION'/" snap/snapcraft.yaml
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Build snap
         id: snapcraft
@@ -169,11 +179,13 @@ jobs:
           SNAP: ${{ steps.snapcraft.outputs.snap }}
           VERSION: ${{ steps.package.outputs.version }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           PACKAGE="OpenCADStudio-v${VERSION}-linux-x86_64.snap"
           mv "$SNAP" "$PACKAGE"
           echo "snap=$PACKAGE" >> "$GITHUB_OUTPUT"
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Upload snap to release
         if: env.RELEASE_TAG != ''
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index a502005ba..b06abf3f8 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -43,13 +43,15 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           PUBLISH: ${{ github.event_name == 'schedule' || inputs.publish }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           if [ "$PUBLISH" = true ]; then
             python3 scripts/release.py prepare --publish
           else
             python3 scripts/release.py prepare
           fi
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
   # GITHUB_TOKEN releases do not trigger release events, so call both builds.
   web: