diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index e5fa2732a757..106bee08b179 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -219,7 +219,7 @@ jobs:
           # Use the target branch to get accurate maintainer info
           nix-build target/ci -A eval.compare \
             --arg beforeResultDir ./targetResult \
-            --arg afterResultDir $(realpath prResult) \
+            --arg afterResultDir "$(realpath prResult)" \
             --arg touchedFilesJson ./touched-files.json \
             -o comparison
 
diff --git a/.github/workflows/lint-actions.sh b/.github/workflows/lint-actions.sh
deleted file mode 100755
index 43d6e801caf6..000000000000
--- a/.github/workflows/lint-actions.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash actionlint shellcheck -I nixpkgs=../..
-set -euo pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-cd "$SCRIPT_DIR/../.."
-actionlint
diff --git a/ci/default.nix b/ci/default.nix
index 9d0fff7d119a..02ada0968f41 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -44,6 +44,8 @@ let
         # By default it's info, which is too noisy since we have many unmatched files
         settings.on-unmatched = "debug";
 
+        programs.actionlint.enable = true;
+
         programs.keep-sorted.enable = true;
 
         # This uses nixfmt-rfc-style underneath,