diff --git a/.mokogit/workflows/branch-cleanup.yml b/.mokogit/workflows/branch-cleanup.yml
index 183b1df..1941449 100644
--- a/.mokogit/workflows/branch-cleanup.yml
+++ b/.mokogit/workflows/branch-cleanup.yml
@@ -36,7 +36,7 @@ jobs:
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           REPO: ${{ github.repository }}
-          API_BASE: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          API_BASE: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
           BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
           set -euo pipefail
diff --git a/.mokogit/workflows/ci-issue-reporter.yml b/.mokogit/workflows/ci-issue-reporter.yml
index cc6dc49..0388f85 100644
--- a/.mokogit/workflows/ci-issue-reporter.yml
+++ b/.mokogit/workflows/ci-issue-reporter.yml
@@ -8,7 +8,7 @@
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
-# BRIEF: Reusable workflow — creates/updates a MokoGIT issue when a CI gate fails.
+# BRIEF: Reusable workflow � creates/updates a MokoGIT issue when a CI gate fails.
 #        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
 
 name: "Universal: CI Issue Reporter"
@@ -50,19 +50,26 @@ jobs:
       - name: Clone MokoCLI
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
         run: |
-          MOKOGIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
           git clone --depth 1 --filter=blob:none --sparse "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
           cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
 
       - name: Report CI failure
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          # Route all workflow_call inputs through env vars — referencing ${{ inputs.* }}
+          # directly in a run: block interpolates at YAML-parse time and is a shell-injection
+          # vector. Shell variables are not re-parsed, so a crafted input can't break out.
+          INPUT_GATE: ${{ inputs.gate }}
+          INPUT_DETAILS: ${{ inputs.details }}
+          INPUT_SEVERITY: ${{ inputs.severity }}
+          INPUT_WORKFLOW: ${{ inputs.workflow }}
         run: |
           chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
           /tmp/mokocli/cli/ci_issue_reporter.sh \
-            --gate "${{ inputs.gate }}" \
-            --details "${{ inputs.details }}" \
-            --severity "${{ inputs.severity }}" \
-            --workflow "${{ inputs.workflow }}"
+            --gate "$INPUT_GATE" \
+            --details "$INPUT_DETAILS" \
+            --severity "$INPUT_SEVERITY" \
+            --workflow "$INPUT_WORKFLOW"
diff --git a/.mokogit/workflows/cleanup.yml b/.mokogit/workflows/cleanup.yml
index 9c13931..9d97dba 100644
--- a/.mokogit/workflows/cleanup.yml
+++ b/.mokogit/workflows/cleanup.yml
@@ -21,7 +21,7 @@ permissions:
   contents: write
 
 env:
-  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   cleanup:
diff --git a/.mokogit/workflows/custom/workflow-sync-trigger.yml b/.mokogit/workflows/custom/workflow-sync-trigger.yml
index 00d0608..c5b26b1 100644
--- a/.mokogit/workflows/custom/workflow-sync-trigger.yml
+++ b/.mokogit/workflows/custom/workflow-sync-trigger.yml
@@ -53,7 +53,7 @@ jobs:
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
-          MOKOGIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          MOKOGIT_URL="${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}"
           git clone --depth 1 "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
 
       - name: Install PHP
@@ -72,7 +72,7 @@ jobs:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           ARGS="--token ${MOKOGIT_TOKEN}"
-          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
+          ARGS="${ARGS} --org ${{ vars.MOKOGIT_ORG || github.repository_owner }}"
           ARGS="${ARGS} --phase repos"
           ARGS="${ARGS} --delete-orphans"
 
diff --git a/.mokogit/workflows/issue-branch.yml b/.mokogit/workflows/issue-branch.yml
index e736ca8..67a5da2 100644
--- a/.mokogit/workflows/issue-branch.yml
+++ b/.mokogit/workflows/issue-branch.yml
@@ -19,7 +19,7 @@ permissions:
   issues: write
 
 env:
-  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   create-branch:
diff --git a/.mokogit/workflows/pr-check.yml b/.mokogit/workflows/pr-check.yml
index 0e3b0fb..e4ae87e 100644
--- a/.mokogit/workflows/pr-check.yml
+++ b/.mokogit/workflows/pr-check.yml
@@ -146,7 +146,7 @@ jobs:
       - name: Remind to update the wiki
         env:
           TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          SERVER: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
           REPO: ${{ github.repository }}
           PR: ${{ github.event.pull_request.number }}
         run: |
@@ -581,7 +581,7 @@ jobs:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           REPO: ${{ github.repository }}
           BRANCH: ${{ github.head_ref }}
-          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           curl -s -X POST             "${MOKOGIT_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGIT_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
           echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY