diff --git a/.gitea/actions/cleanup/action.yml b/.gitea/actions/cleanup/action.yml
index 7b91f10..663d956 100644
--- a/.gitea/actions/cleanup/action.yml
+++ b/.gitea/actions/cleanup/action.yml
@@ -17,9 +17,9 @@ runs:
 
         readarray -t skins <<< "${{ inputs.all_skins }}"
 
-        [ -f how-to-use.md ] && rm -f how-to-use.md
-        [ -f src/replay.osr ] && rm -f src/replay.osr
-        [ -d src/default-skin ] && rm -rf src/default-skin
+        [ -f how-to-use.md ] && rm -f -- how-to-use.md
+        [ -f src/replay.osr ] && rm -f -- src/replay.osr
+        [ -d src/default-skin ] && rm -rf -- src/default-skin
 
         sanitize_filename() {
           echo "$1" | \
@@ -40,7 +40,7 @@ runs:
               continue
             fi
             echo " → Removing unexpected root file: $f"
-            rm -f "$f"
+            rm -f -- "$f"
           done
 
           dir="$root/$skin"
@@ -49,7 +49,7 @@ runs:
             [ -e "$f" ] || continue
             if [[ "$(basename "$f")" != "$expected" ]]; then
               echo " → Removing unexpected file: $f"
-              rm -f "$f"
+              rm -f -- "$f"
             fi
           done
         }
@@ -61,14 +61,14 @@ runs:
             name="$(basename "$dir")"
             if ! printf '%s\n' "${skins[@]}" | grep -Fxq -- "$name"; then
               echo " → Skin '$name' deleted—removing directory $dir"
-              rm -rf "$dir"
+              rm -rf -- "$dir"
             fi
           done
         done
 
         for skin in "${skins[@]}"; do
           header=$(sanitize_filename "$skin")
-          ini=$(find "$DANSER_SKINS_DIR/$skin" -maxdepth 1 -type f -iname "skin.ini" -print -quit || true)
+          ini=$(find -- "$DANSER_SKINS_DIR/$skin" -maxdepth 1 -type f -iname "skin.ini" -print -quit || true)
           if [[ -f "$ini" ]]; then
             raw=$(grep -i '^[[:space:]]*Name:' "$ini" | head -n1 || true)
             raw="${raw#*:}"