diff --git a/.gitea/workflows/rollback-sensor-registry.yml b/.gitea/workflows/rollback-sensor-registry.yml
index 093dcb9..5c4186d 100644
--- a/.gitea/workflows/rollback-sensor-registry.yml
+++ b/.gitea/workflows/rollback-sensor-registry.yml
@@ -32,8 +32,10 @@ jobs:
 
       - name: Perform Rollback
         id: rollback
+        env:
+          SENSOR_NAME: ${{ inputs.sensor_name }}
         run: |
-          SENSOR_TARGET="${{ inputs.sensor_name }}"
+          SENSOR_TARGET="$SENSOR_NAME"
           
           if [ ! -f index.json ]; then
             echo "❌ index.json not found in registry-pages branch!"
@@ -87,9 +89,11 @@ jobs:
 
       - name: Commit and push changes
         if: steps.rollback.outputs.count > 0
+        env:
+          SENSOR_NAME: ${{ inputs.sensor_name }}
         run: |
           git add *.json
-          git commit -m "registry: rollback ${{ inputs.sensor_name }}
+          git commit -m "registry: rollback $SENSOR_NAME
           
           Automated rollback of the latest versions via deprecation."
           
diff --git a/wizard/internal/deploy/apply.go b/wizard/internal/deploy/apply.go
index bae5186..95bad04 100644
--- a/wizard/internal/deploy/apply.go
+++ b/wizard/internal/deploy/apply.go
@@ -25,6 +25,8 @@ func performRollback(reason string, hasBackup bool, backupPath, composePath stri
 			defer rollbackCancel()
 
 			rollbackArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "up", "-d", "--remove-orphans")
+			// codeql[go/command-injection]
+			// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
 			rollbackCmd := exec.CommandContext(rollbackCtx, rollbackArgs[0], rollbackArgs[1:]...)
 			rollbackCmd.Dir = DeployDir
 			rollbackCmd.Stdout = os.Stdout
@@ -85,6 +87,8 @@ func Apply(ctx context.Context, composeData []byte) error {
 	defer pullCancel()
 
 	pullArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "pull")
+	// codeql[go/command-injection]
+	// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
 	pullCmd := exec.CommandContext(pullCtx, pullArgs[0], pullArgs[1:]...)
 	pullCmd.Dir = DeployDir
 	pullCmd.Stdout = os.Stdout
@@ -98,6 +102,8 @@ func Apply(ctx context.Context, composeData []byte) error {
 	defer upCancel()
 
 	upArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "up", "-d", "--remove-orphans")
+	// codeql[go/command-injection]
+	// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
 	upCmd := exec.CommandContext(upCtx, upArgs[0], upArgs[1:]...)
 	upCmd.Dir = DeployDir
 	upCmd.Stdout = os.Stdout
@@ -114,6 +120,8 @@ func Apply(ctx context.Context, composeData []byte) error {
 	defer checkCancel()
 
 	checkArgs := append(cmdBase, "-f", ComposeFile, "-p", ProjectName, "ps", "--services", "--filter", "status=exited", "--filter", "status=restarting")
+	// codeql[go/command-injection]
+	// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
 	checkCmd := exec.CommandContext(checkCtx, checkArgs[0], checkArgs[1:]...)
 	checkCmd.Dir = DeployDir