diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 172b93a..5b5d551 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,6 @@
 ---
 name: publish
+run-name: Publish ${{ github.ref_name }}
 
 on:
   push:
@@ -74,6 +75,7 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.GH_TOKEN }}
   docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v7
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 0debc49..3814045 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -1,5 +1,6 @@
 ---
 name: version
+run-name: Cut ${{ github.event.inputs.version }}${{ github.event.client_payload.version }}
 
 on:
   workflow_dispatch:
@@ -42,6 +43,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
       - name: Cut ${{ github.event.inputs.version }}${{ github.event.client_payload.version }} version
-        run: npm version --sign-git-tag=true ${{ github.event.inputs.version }}${{ github.event.client_payload.version }}
+        run: npm version --sign-git-tag=true "$VERSION"
         env:
+          VERSION: ${{ github.event.inputs.version }}${{ github.event.client_payload.version }}
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 005c273..782572b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
+- Harden the deploy workflows: pass the version input through `env:` instead of interpolating it into the shell line; give the dispatch and tag workflows readable run titles; give every job a timeout.
+
 - GitHub Actions updated to Node 24 runtimes: `actions/checkout` v5 to v7; `actions/setup-node` v5 to v6.
 
 ## 0.8.2 / 2026-07-05