diff --git a/.changeset/patch-templatable-integer-safe-output.md b/.changeset/patch-templatable-integer-safe-output.md
new file mode 100644
index 0000000000..d97baeda2c
--- /dev/null
+++ b/.changeset/patch-templatable-integer-safe-output.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Allow safe output `max`/`expires` fields to accept templated integers so expressions like `${{ inputs.max-issues }}` continue to work in addition to literal numbers.
diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 30b4610c1a..29b0454922 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -1119,7 +1119,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Agent Performance Analyzer - Meta-Orchestrator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 28cbd7b66b..0da2e652eb 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -985,7 +985,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Agent Persona Explorer"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
index 74ca7e3470..f38123191f 100644
--- a/.github/workflows/ai-moderator.lock.yml
+++ b/.github/workflows/ai-moderator.lock.yml
@@ -983,7 +983,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "AI Moderator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index 17ea0f5a37..11116c68a7 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -931,7 +931,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Archie"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index 6f1477f7e5..6e37efba24 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -892,7 +892,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Artifacts Summary"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index fc24db2fc8..6fc0a4c794 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -1151,7 +1151,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Agentic Workflow Audit Agent"
           GH_AW_TRACKER_ID: "audit-workflows-daily"
         with:
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index fa5503cea3..47d30a0063 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -966,7 +966,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Auto-Triage Issues"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml
index 21d8549f4e..7a1098418c 100644
--- a/.github/workflows/blog-auditor.lock.yml
+++ b/.github/workflows/blog-auditor.lock.yml
@@ -997,7 +997,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Blog Auditor"
           GH_AW_TRACKER_ID: "blog-auditor-weekly"
         with:
diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml
index ae31b29b37..8e6cce6670 100644
--- a/.github/workflows/bot-detection.lock.yml
+++ b/.github/workflows/bot-detection.lock.yml
@@ -1043,7 +1043,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Bot Detection"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index cba40abfcf..c20b81ee24 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -926,7 +926,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Brave Web Search Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index 03c781fc6c..0ac1b28e74 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -935,7 +935,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Breaking Change Checker"
           GH_AW_TRACKER_ID: "breaking-change-checker"
         with:
diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
index dc7d277110..8a35aae920 100644
--- a/.github/workflows/changeset.lock.yml
+++ b/.github/workflows/changeset.lock.yml
@@ -1017,7 +1017,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Changeset Generator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index d16d4c3051..3271c8fc67 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -995,7 +995,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "CI Optimization Coach"
           GH_AW_TRACKER_ID: "ci-coach-daily"
         with:
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 07dd9b4b35..08c91657c0 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -1134,7 +1134,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "CI Failure Doctor"
           GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/ci-doctor.md@ea350161ad5dcc9624cf510f134c6a9e39a6f94d"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/ea350161ad5dcc9624cf510f134c6a9e39a6f94d/workflows/ci-doctor.md"
diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml
index 4e34294cbb..b709b92872 100644
--- a/.github/workflows/claude-code-user-docs-review.lock.yml
+++ b/.github/workflows/claude-code-user-docs-review.lock.yml
@@ -959,7 +959,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Claude Code User Documentation Review"
           GH_AW_TRACKER_ID: "claude-code-user-docs-review"
         with:
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index b825d00598..4992faab91 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -904,7 +904,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "CLI Consistency Checker"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index 7840a9d46c..db4ad7d35d 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -993,7 +993,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "CLI Version Checker"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index 43dc4c3e91..b0ab68c22b 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -1271,7 +1271,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "/cloclo"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index 65d8b8927d..3ef1c1618e 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -1005,7 +1005,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Code Scanning Fixer"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 35d94adda0..6c688c2b9c 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -922,7 +922,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Code Simplifier"
           GH_AW_TRACKER_ID: "code-simplifier"
         with:
diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml
index 07bfd1f084..142bab15c0 100644
--- a/.github/workflows/commit-changes-analyzer.lock.yml
+++ b/.github/workflows/commit-changes-analyzer.lock.yml
@@ -943,7 +943,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Commit Changes Analyzer"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index 6a4a079265..3b3aabc915 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -986,7 +986,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Contribution Check"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml
index 65b7a5113d..b4458a5d28 100644
--- a/.github/workflows/copilot-agent-analysis.lock.yml
+++ b/.github/workflows/copilot-agent-analysis.lock.yml
@@ -1043,7 +1043,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Copilot Agent PR Analysis"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index f640841a77..088ff8a2ae 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -952,7 +952,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Copilot CLI Deep Research Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index 4f93694ffe..11d359d425 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -949,7 +949,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Copilot PR Merged Report"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index 9e498a41c8..a431be5887 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -1050,7 +1050,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Copilot PR Conversation NLP Analysis"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index e513012db4..b4f3577a30 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -968,7 +968,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Copilot PR Prompt Pattern Analysis"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml
index fa33a1591c..80585f0482 100644
--- a/.github/workflows/copilot-session-insights.lock.yml
+++ b/.github/workflows/copilot-session-insights.lock.yml
@@ -1106,7 +1106,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Copilot Session Insights"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 162b5076f2..dbffa20445 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -966,7 +966,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Workflow Craft Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index 8c5beeef3b..c22fd799de 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -924,7 +924,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Auto-Assign Issue"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml
index 1aa5c9a984..b3085e835c 100644
--- a/.github/workflows/daily-choice-test.lock.yml
+++ b/.github/workflows/daily-choice-test.lock.yml
@@ -899,7 +899,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Choice Type Test"
           GH_AW_TRACKER_ID: "daily-choice-test"
         with:
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 2f21e0500e..17c6eec810 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -1144,7 +1144,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily CLI Performance Agent"
           GH_AW_TRACKER_ID: "daily-cli-performance"
         with:
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index a392a4b63b..2fb690f38e 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -972,7 +972,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily CLI Tools Exploratory Tester"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml
index c33f7858bc..1a522794b8 100644
--- a/.github/workflows/daily-code-metrics.lock.yml
+++ b/.github/workflows/daily-code-metrics.lock.yml
@@ -1080,7 +1080,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Code Metrics and Trend Tracking Agent"
           GH_AW_TRACKER_ID: "daily-code-metrics"
         with:
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 1d7a9c5cf6..71afd0cc7c 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -942,7 +942,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Compiler Quality Check"
           GH_AW_TRACKER_ID: "daily-compiler-quality"
         with:
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index a3bb599bbe..cf1843e26c 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -1061,7 +1061,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Copilot Token Consumption Report"
           GH_AW_TRACKER_ID: "daily-copilot-token-report"
         with:
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index dbad44c431..c4918a1b80 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -1007,7 +1007,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Documentation Updater"
           GH_AW_TRACKER_ID: "daily-doc-updater"
         with:
diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml
index 0457f16c21..5faab75d67 100644
--- a/.github/workflows/daily-fact.lock.yml
+++ b/.github/workflows/daily-fact.lock.yml
@@ -852,7 +852,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Fact About gh-aw"
           GH_AW_TRACKER_ID: "daily-fact-thread"
         with:
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index e4c9600f9c..2fc65174ec 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -948,7 +948,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily File Diet"
           GH_AW_TRACKER_ID: "daily-file-diet"
         with:
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index 3630b0056c..a0ca85e05a 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -1059,7 +1059,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Firewall Logs Collector and Reporter"
           GH_AW_TRACKER_ID: "daily-firewall-report"
         with:
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index 561c0cf2c5..7e7320ae1c 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -1089,7 +1089,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Issues Report Generator"
           GH_AW_TRACKER_ID: "daily-issues-report"
         with:
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index ce113f6a38..2d1f8adb0e 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -928,7 +928,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Malicious Code Scan Agent"
           GH_AW_TRACKER_ID: "malicious-code-scan"
         with:
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index dd695e5900..317b28a17d 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -1003,7 +1003,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily MCP Tool Concurrency Analysis"
           GH_AW_TRACKER_ID: "mcp-concurrency-analysis"
         with:
diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml
index cd20e0ea0d..f4123d85ca 100644
--- a/.github/workflows/daily-multi-device-docs-tester.lock.yml
+++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml
@@ -1082,7 +1082,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Multi-Device Docs Tester"
           GH_AW_TRACKER_ID: "daily-multi-device-docs-tester"
         with:
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index c54fdd8b5a..188aeb677b 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -1123,7 +1123,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily News"
           GH_AW_TRACKER_ID: "daily-news-weekday"
         with:
diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
index 65ec89ee9c..6d72dcb826 100644
--- a/.github/workflows/daily-observability-report.lock.yml
+++ b/.github/workflows/daily-observability-report.lock.yml
@@ -1040,7 +1040,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Observability Report for AWF Firewall and MCP Gateway"
           GH_AW_TRACKER_ID: "daily-observability-report"
         with:
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 8166eb2022..b5c4ea36ad 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -1552,7 +1552,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Project Performance Summary Generator (Using Safe Inputs)"
           GH_AW_TRACKER_ID: "daily-performance-summary"
         with:
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index 61b0fefb6c..45042470b4 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -1438,7 +1438,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Regulatory Report Generator"
           GH_AW_TRACKER_ID: "daily-regulatory"
         with:
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index 7d8fa44b93..1b1a111248 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -1093,7 +1093,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Rendering Scripts Verifier"
           GH_AW_TRACKER_ID: "daily-rendering-scripts-verifier"
         with:
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 1d4b114c56..99aeb5343b 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -994,7 +994,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "The Daily Repository Chronicle"
           GH_AW_TRACKER_ID: "daily-repo-chronicle"
         with:
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index 2b4970ba62..64e16a761e 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -1082,7 +1082,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Safe Output Tool Optimizer"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/daily-safe-outputs-conformance.lock.yml b/.github/workflows/daily-safe-outputs-conformance.lock.yml
index 4260078fe6..8b4d30fb7b 100644
--- a/.github/workflows/daily-safe-outputs-conformance.lock.yml
+++ b/.github/workflows/daily-safe-outputs-conformance.lock.yml
@@ -956,7 +956,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Safe Outputs Conformance Checker"
           GH_AW_TRACKER_ID: "safe-outputs-conformance"
         with:
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index 69549c51d4..cb5d79711f 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -956,7 +956,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Secrets Analysis Agent"
           GH_AW_TRACKER_ID: "daily-secrets-analysis"
         with:
diff --git a/.github/workflows/daily-security-red-team.lock.yml b/.github/workflows/daily-security-red-team.lock.yml
index 51e484990e..35fe8dfb88 100644
--- a/.github/workflows/daily-security-red-team.lock.yml
+++ b/.github/workflows/daily-security-red-team.lock.yml
@@ -960,7 +960,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Security Red Team Agent"
           GH_AW_TRACKER_ID: "security-red-team"
         with:
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index 4648e57914..080a07d48e 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -942,7 +942,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Semgrep Scan"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml
index abdabf9a34..60c8145a35 100644
--- a/.github/workflows/daily-syntax-error-quality.lock.yml
+++ b/.github/workflows/daily-syntax-error-quality.lock.yml
@@ -933,7 +933,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Syntax Error Quality Check"
           GH_AW_TRACKER_ID: "daily-syntax-error-quality"
         with:
diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml
index 30052d1997..fb8168fa8a 100644
--- a/.github/workflows/daily-team-evolution-insights.lock.yml
+++ b/.github/workflows/daily-team-evolution-insights.lock.yml
@@ -938,7 +938,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Team Evolution Insights"
           GH_AW_TRACKER_ID: "daily-team-evolution-insights"
         with:
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 8621cf6c9a..ba8543a5a3 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -920,7 +920,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Team Status"
           GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-team-status.md@d3422bf940923ef1d43db5559652b8e1e71869f3"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d3422bf940923ef1d43db5559652b8e1e71869f3/workflows/daily-team-status.md"
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index f54a0d9888..c8b2fd4591 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -985,7 +985,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Testify Uber Super Expert"
           GH_AW_TRACKER_ID: "daily-testify-uber-super-expert"
         with:
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index 801d2ea0af..36ca8334b9 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -908,7 +908,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Daily Workflow Updater"
           GH_AW_TRACKER_ID: "daily-workflow-updater"
         with:
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index 5fa6f2e5c4..bfe50f53bb 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -1174,7 +1174,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "DeepReport - Intelligence Gathering Agent"
           GH_AW_TRACKER_ID: "deep-report-intel-agent"
         with:
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index a59e1c5417..7cdbd7fc0c 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -1036,7 +1036,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Delight"
           GH_AW_TRACKER_ID: "delight-daily"
         with:
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index 36f0aa88ec..6cc49e2f43 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -905,7 +905,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Dependabot Burner"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 7b1ecc0245..79803409e1 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -950,7 +950,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Dependabot Dependency Checker"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index c287ae1924..14e286a5ed 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -988,7 +988,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Dev Hawk"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index f8d42d5f37..e4cc1e96d6 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -901,7 +901,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Dev"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index e195a134bc..9c1a86d83a 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -1090,7 +1090,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Developer Documentation Consolidator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index d12e0c29c5..bbe01742c6 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -914,7 +914,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Dictation Prompt Generator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index b939c37d0f..bcc1535a2e 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -1019,7 +1019,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Discussion Task Miner - Code Quality Improvement Agent"
           GH_AW_TRACKER_ID: "discussion-task-miner"
         with:
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index b60ca73470..465e206eea 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -948,7 +948,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Documentation Noob Tester"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index a3d3c16152..e07708db2d 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -958,7 +958,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Draft PR Cleanup"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index efed788f4a..6d979a4f56 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -949,7 +949,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Duplicate Code Detector"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
index cb688a7959..ab7e772373 100644
--- a/.github/workflows/example-workflow-analyzer.lock.yml
+++ b/.github/workflows/example-workflow-analyzer.lock.yml
@@ -1001,7 +1001,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Weekly Workflow Analysis"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index 0f62eb85b5..43c33171a1 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -966,7 +966,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "The Great Escapi"
           GH_AW_TRACKER_ID: "firewall-escape"
         with:
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index a3dbaa81ac..edf43b7f31 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -916,7 +916,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Functional Pragmatist"
           GH_AW_TRACKER_ID: "functional-pragmatist"
         with:
diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
index 42b477f0df..18c933494a 100644
--- a/.github/workflows/github-mcp-structural-analysis.lock.yml
+++ b/.github/workflows/github-mcp-structural-analysis.lock.yml
@@ -1043,7 +1043,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "GitHub MCP Structural Analysis"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index b32963a9eb..0d0eeb3a4d 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -1051,7 +1051,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "GitHub MCP Remote Server Tools Report Generator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index f63eefd152..50b74fd562 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -896,7 +896,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "GitHub Remote MCP Authentication Test"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 94c570b2b7..89e8e01041 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -990,7 +990,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Glossary Maintainer"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml
index 4c67fb64dd..a6afbe9d02 100644
--- a/.github/workflows/go-fan.lock.yml
+++ b/.github/workflows/go-fan.lock.yml
@@ -999,7 +999,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Go Fan"
           GH_AW_TRACKER_ID: "go-fan-daily"
         with:
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index 956561bbb6..e8cdaedc6b 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -1177,7 +1177,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Go Logger Enhancement"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index fdeab05b39..aae922afe1 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -1002,7 +1002,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Go Pattern Detector"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index a208b41dd0..ff923af20d 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -933,7 +933,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "GPL Dependency Cleaner (gpclean)"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index 91c3a22a87..b67668a6ec 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -1015,7 +1015,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Grumpy Code Reviewer 🔥"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index e2719295e7..3a7fd62731 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -1012,7 +1012,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "CI Cleaner"
           GH_AW_TRACKER_ID: "hourly-ci-cleaner"
         with:
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index 0892efb556..b144b54a29 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -1005,7 +1005,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Instructions Janitor"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml
index 29364026fe..71e48141bd 100644
--- a/.github/workflows/issue-arborist.lock.yml
+++ b/.github/workflows/issue-arborist.lock.yml
@@ -1032,7 +1032,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Issue Arborist"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index b5f1f37016..5ed42a4b2b 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -956,7 +956,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Issue Monster"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index e2cfd4f2d4..656ffecf21 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -895,7 +895,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index 6d80f3683d..5131ef8272 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -952,7 +952,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "jsweep - JavaScript Unbloater"
           GH_AW_TRACKER_ID: "jsweep-daily"
         with:
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index c11d936595..4513b4891d 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -945,7 +945,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Layout Specification Maintainer"
           GH_AW_TRACKER_ID: "layout-spec-maintainer"
         with:
diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
index 01285885a5..e78c75bb55 100644
--- a/.github/workflows/lockfile-stats.lock.yml
+++ b/.github/workflows/lockfile-stats.lock.yml
@@ -963,7 +963,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Lockfile Statistics Analysis Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 11f6e33842..8ed0d4bd1d 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1298,7 +1298,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "MCP Inspector Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index cc3979b023..56c16ccb1b 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -954,7 +954,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Mergefest"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index d80261b5c6..a500e2990d 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -867,7 +867,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Issue Summary to Notion"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index 2f3fb5a320..e9327dc559 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -997,7 +997,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Organization Health Report"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index 70c2a4e777..3a44f67ba0 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -1029,7 +1029,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Resource Summarizer Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index d32c8c4e12..a0f0ea24ae 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -998,7 +998,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Plan Command"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 1a5e1a09ac..89d61d4a09 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -1661,7 +1661,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Poem Bot - A Creative Agentic Workflow"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index 5bf654dfca..e337bf22d7 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -1070,7 +1070,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Automated Portfolio Analyst"
           GH_AW_TRACKER_ID: "portfolio-analyst-weekly"
         with:
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index ee6f010635..7abfe63a1a 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -1106,7 +1106,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "PR Nitpick Reviewer 🔍"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index c82213df71..083e246bee 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -1029,7 +1029,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "PR Triage Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 05f97a6359..052e403ed2 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -1094,7 +1094,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Copilot Agent Prompt Clustering Analysis"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index e831285825..3c8f535a7b 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -1060,7 +1060,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Python Data Visualization Generator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 47c3004dc5..46670bb7eb 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -1132,7 +1132,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Q"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index 99940de371..051fbd7d3b 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -983,7 +983,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Code Refiner"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 4ffe685b7a..dffaa03304 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -913,7 +913,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Release"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index bda0ec9e58..53ed40a531 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -928,7 +928,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Repository Audit & Agentic Workflow Opportunity Analyzer"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index f0b3a32540..8b958a3f14 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -888,7 +888,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Repository Tree Map Generator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index a23514eef1..fe61a3edaf 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -929,7 +929,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Repository Quality Improvement Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index 9d6207287c..f3424da67f 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -916,7 +916,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Basic Research Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index a0e018fe20..f438a0dea4 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -1056,7 +1056,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Safe Output Health Monitor"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml
index 05b5fd4e77..75e2c8f45c 100644
--- a/.github/workflows/schema-consistency-checker.lock.yml
+++ b/.github/workflows/schema-consistency-checker.lock.yml
@@ -964,7 +964,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Schema Consistency Checker"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index f52a61f83c..b2f8f5384f 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -1109,7 +1109,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Scout"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index 1a0c253de0..7b77f8e110 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -970,7 +970,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Security Compliance Campaign"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 602575c07f..7bf1c7e4d4 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -1086,7 +1086,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Security Review Agent 🔒"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml
index 9a96f24856..3feea842a5 100644
--- a/.github/workflows/semantic-function-refactor.lock.yml
+++ b/.github/workflows/semantic-function-refactor.lock.yml
@@ -1038,7 +1038,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Semantic Function Refactoring"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml
index 0ff8227681..11bd2b5099 100644
--- a/.github/workflows/sergo.lock.yml
+++ b/.github/workflows/sergo.lock.yml
@@ -998,7 +998,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Sergo - Serena Go Expert"
           GH_AW_TRACKER_ID: "sergo-daily"
         with:
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index bb360819e9..2da749d175 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -1011,7 +1011,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Slide Deck Maintainer"
           GH_AW_TRACKER_ID: "slide-deck-maintainer"
         with:
diff --git a/.github/workflows/smoke-agent.lock.yml b/.github/workflows/smoke-agent.lock.yml
index 687fcd2bde..d13824fb1b 100644
--- a/.github/workflows/smoke-agent.lock.yml
+++ b/.github/workflows/smoke-agent.lock.yml
@@ -971,7 +971,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index f5df6f3a15..c2e0947565 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -2535,7 +2535,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Claude"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index ee097e6497..14308df75d 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -1437,7 +1437,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Codex"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index db2175c87f..5fb6f367ef 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -1962,7 +1962,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Copilot ARM64"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index a031036311..d9e8535261 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -1964,7 +1964,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Copilot"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml
index d1d6955c67..c3908b61b6 100644
--- a/.github/workflows/smoke-gemini.lock.yml
+++ b/.github/workflows/smoke-gemini.lock.yml
@@ -404,7 +404,7 @@ jobs:
               version: "",
               agent_version: "",
               workflow_name: "Smoke Gemini",
-              experimental: true,
+              experimental: false,
               supports_tools_allowlist: true,
               run_id: context.runId,
               run_number: context.runNumber,
@@ -1165,7 +1165,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Gemini"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml
index e630613dd6..dbaebbb241 100644
--- a/.github/workflows/smoke-multi-pr.lock.yml
+++ b/.github/workflows/smoke-multi-pr.lock.yml
@@ -1014,7 +1014,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Multi PR"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index 11096b6981..2c613d142d 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -1428,7 +1428,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Project"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml
index d396985db5..fd5db13408 100644
--- a/.github/workflows/smoke-temporary-id.lock.yml
+++ b/.github/workflows/smoke-temporary-id.lock.yml
@@ -1032,7 +1032,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Smoke Temporary ID"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index d5a3db35c5..1917ab5476 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -927,7 +927,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Agent Container Smoke Test"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index 507a13be36..6616e87df8 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -1065,7 +1065,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Stale Repository Identifier"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index f1aad5616f..0c5e719add 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -1038,7 +1038,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Static Analysis Report"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml
index 1384ec6a7e..6614a53f82 100644
--- a/.github/workflows/step-name-alignment.lock.yml
+++ b/.github/workflows/step-name-alignment.lock.yml
@@ -992,7 +992,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Step Name Alignment"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index 4dd17cd9c4..70598a2657 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -990,7 +990,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Sub-Issue Closer"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 29cf0a58d4..f00fd0927c 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -948,7 +948,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Super Linter Report"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 5cc6185ed3..999848e10d 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -1071,7 +1071,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Rebuild the documentation after making changes"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index 32e6170c2a..6bac3c6526 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -889,7 +889,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Terminal Stylist"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-create-pr-error-handling.lock.yml b/.github/workflows/test-create-pr-error-handling.lock.yml
index 76f8161ae8..af90961143 100644
--- a/.github/workflows/test-create-pr-error-handling.lock.yml
+++ b/.github/workflows/test-create-pr-error-handling.lock.yml
@@ -979,7 +979,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Test Create PR Error Handling"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-dispatcher.lock.yml b/.github/workflows/test-dispatcher.lock.yml
index 7151f399c7..2dbf717e06 100644
--- a/.github/workflows/test-dispatcher.lock.yml
+++ b/.github/workflows/test-dispatcher.lock.yml
@@ -840,7 +840,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Test Dispatcher Workflow"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-project-url-default.lock.yml b/.github/workflows/test-project-url-default.lock.yml
index 9c57490fb2..fd7e05f8f4 100644
--- a/.github/workflows/test-project-url-default.lock.yml
+++ b/.github/workflows/test-project-url-default.lock.yml
@@ -1087,7 +1087,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Test Project URL Explicit Requirement"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index e13e7221f0..08d4ba79e5 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -1044,7 +1044,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Tidy"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml
index a03c7870ca..a17bd8e804 100644
--- a/.github/workflows/typist.lock.yml
+++ b/.github/workflows/typist.lock.yml
@@ -970,7 +970,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Typist - Go Type Analysis"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 9a36d63c0a..20d51afc81 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -941,7 +941,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Ubuntu Actions Image Analyzer"
           GH_AW_TRACKER_ID: "ubuntu-image-analyzer"
         with:
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index 27df091d33..420a1e3c0e 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -1211,7 +1211,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Documentation Unbloat"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index 256cd6f4bc..44a4f85709 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -942,7 +942,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Video Analysis Agent"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index 008eba7bc6..e91d75c562 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -993,7 +993,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Weekly Editors Health Check"
           GH_AW_TRACKER_ID: "weekly-editors-health-check"
         with:
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index 8a49604c0c..d99aa16a41 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -969,7 +969,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Weekly Issue Summary"
           GH_AW_TRACKER_ID: "weekly-issue-summary"
         with:
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index 019d221205..c2ba4dc4ed 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -907,7 +907,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Weekly Safe Outputs Specification Review"
           GH_AW_TRACKER_ID: "weekly-safe-outputs-spec-review"
         with:
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index 26f6cca03a..95254ba417 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -1036,7 +1036,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Workflow Generator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index 3a0631ae7d..89a2de5be0 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -1117,7 +1117,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Workflow Health Manager - Meta-Orchestrator"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index aa609475de..f745f1be16 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -978,7 +978,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Workflow Normalizer"
           GH_AW_TRACKER_ID: "workflow-normalizer"
         with:
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index b28205f16a..20d72bd634 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -987,7 +987,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Workflow Skill Extractor"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/actions/setup/js/templatable.cjs b/actions/setup/js/templatable.cjs
index 4526d288c5..c2035e3e90 100644
--- a/actions/setup/js/templatable.cjs
+++ b/actions/setup/js/templatable.cjs
@@ -35,4 +35,29 @@ function parseBoolTemplatable(value, defaultValue = true) {
   return String(value) !== "false";
 }
 
-module.exports = { parseBoolTemplatable };
+/**
+ * Parses a templatable integer config value.
+ *
+ * Handles all representations that can arrive in a handler config:
+ *  - `undefined` / `null`       → `defaultValue`
+ *  - number `5`                 → `5`
+ *  - string `"5"`               → `5`
+ *  - string that is not a valid integer → `defaultValue`
+ *
+ * GitHub Actions expression strings (e.g. "${{ inputs.max-issues }}")
+ * are resolved by the runner before the config JSON is parsed, so by
+ * the time this function is called the value is already a plain
+ * integer string.
+ *
+ * @param {any} value - The config field value to parse.
+ * @param {number} [defaultValue=0] - Value returned when `value` is
+ *   `undefined`, `null`, or not a valid integer.
+ * @returns {number}
+ */
+function parseIntTemplatable(value, defaultValue = 0) {
+  if (value === undefined || value === null) return defaultValue;
+  const n = parseInt(String(value), 10);
+  return isNaN(n) ? defaultValue : n;
+}
+
+module.exports = { parseBoolTemplatable, parseIntTemplatable };
diff --git a/actions/setup/js/templatable.test.cjs b/actions/setup/js/templatable.test.cjs
index e5ee5e3e75..9a39c955b6 100644
--- a/actions/setup/js/templatable.test.cjs
+++ b/actions/setup/js/templatable.test.cjs
@@ -1,6 +1,6 @@
 import { describe, it, expect } from "vitest";
 
-const { parseBoolTemplatable } = require("./templatable.cjs");
+const { parseBoolTemplatable, parseIntTemplatable } = require("./templatable.cjs");
 
 describe("templatable.cjs", () => {
   describe("parseBoolTemplatable", () => {
@@ -44,4 +44,47 @@ describe("templatable.cjs", () => {
       expect(parseBoolTemplatable("false", true)).toBe(false);
     });
   });
+
+  describe("parseIntTemplatable", () => {
+    it("returns defaultValue (0) for undefined", () => {
+      expect(parseIntTemplatable(undefined)).toBe(0);
+    });
+
+    it("returns defaultValue (0) for null", () => {
+      expect(parseIntTemplatable(null)).toBe(0);
+    });
+
+    it("respects a custom defaultValue", () => {
+      expect(parseIntTemplatable(undefined, 5)).toBe(5);
+      expect(parseIntTemplatable(null, 10)).toBe(10);
+    });
+
+    it("handles integer numbers", () => {
+      expect(parseIntTemplatable(5)).toBe(5);
+      expect(parseIntTemplatable(0)).toBe(0);
+      expect(parseIntTemplatable(100)).toBe(100);
+    });
+
+    it("handles numeric strings", () => {
+      expect(parseIntTemplatable("5")).toBe(5);
+      expect(parseIntTemplatable("42")).toBe(42);
+      expect(parseIntTemplatable("0")).toBe(0);
+    });
+
+    it("handles resolved GitHub Actions expression values (integers as strings)", () => {
+      // After runtime evaluation, expressions like "${{ inputs.max }}" become strings like "5"
+      expect(parseIntTemplatable("3")).toBe(3);
+      expect(parseIntTemplatable("168")).toBe(168);
+    });
+
+    it("returns defaultValue for non-numeric strings", () => {
+      expect(parseIntTemplatable("not-a-number")).toBe(0);
+      expect(parseIntTemplatable("abc", 1)).toBe(1);
+    });
+
+    it("truncates floating point numbers to integers", () => {
+      expect(parseIntTemplatable(3.7)).toBe(3);
+      expect(parseIntTemplatable("2.9")).toBe(2);
+    });
+  });
 });
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index 0b916da3a5..6e05ab5c6a 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -1315,9 +1315,18 @@
                       "description": "GitHub search query string to check before running workflow. Query is automatically scoped to the current repository."
                     },
                     "max": {
-                      "type": "integer",
-                      "minimum": 1,
-                      "description": "Maximum number of items that must be matched for the workflow to be skipped. Defaults to 1 if not specified."
+                      "description": "Maximum number of items that must be matched for the workflow to be skipped. Defaults to 1 if not specified. Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                      "oneOf": [
+                        {
+                          "type": "integer",
+                          "minimum": 1
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "^\\$\\{\\{.*\\}\\}$",
+                          "description": "GitHub Actions expression that resolves to an integer at runtime"
+                        }
+                      ]
                     }
                   },
                   "additionalProperties": false,
@@ -1387,12 +1396,12 @@
               "description": "Skip workflow execution for specific GitHub users. Useful for preventing workflows from running for specific accounts (e.g., bots, specific team members)."
             },
             "roles": {
-              "description": "Repository access roles required to trigger agentic workflows. Defaults to ['admin', 'maintainer', 'write'] for security. Use 'all' to allow any authenticated user (\u26a0\ufe0f security consideration).",
+              "description": "Repository access roles required to trigger agentic workflows. Defaults to ['admin', 'maintainer', 'write'] for security. Use 'all' to allow any authenticated user (⚠️ security consideration).",
               "oneOf": [
                 {
                   "type": "string",
                   "enum": ["all"],
-                  "description": "Allow any authenticated user to trigger the workflow (\u26a0\ufe0f disables permission checking entirely - use with caution)"
+                  "description": "Allow any authenticated user to trigger the workflow (⚠️ disables permission checking entirely - use with caution)"
                 },
                 {
                   "type": "array",
@@ -2167,7 +2176,7 @@
     },
     "network": {
       "$comment": "Strict mode requirements: When strict=true, the 'network' field must be present (not null/undefined) and cannot contain standalone wildcard '*' in allowed domains (but patterns like '*.example.com' ARE allowed). This is validated in Go code (pkg/workflow/strict_mode_validation.go) via validateStrictNetwork().",
-      "description": "Network access control for AI engines using ecosystem identifiers and domain allowlists. Supports wildcard patterns like '*.example.com' to match any subdomain. Controls web fetch and search capabilities. IMPORTANT: For workflows that build/install/test code, always include the language ecosystem identifier alongside 'defaults' \u2014 'defaults' alone only covers basic infrastructure, not package registries. Key ecosystem identifiers by runtime: 'dotnet' (.NET/NuGet), 'python' (pip/PyPI), 'node' (npm/yarn), 'go' (go modules), 'java' (Maven/Gradle), 'ruby' (Bundler), 'rust' (Cargo), 'swift' (Swift PM). Example: a .NET project needs network: { allowed: [defaults, dotnet] }.",
+      "description": "Network access control for AI engines using ecosystem identifiers and domain allowlists. Supports wildcard patterns like '*.example.com' to match any subdomain. Controls web fetch and search capabilities. IMPORTANT: For workflows that build/install/test code, always include the language ecosystem identifier alongside 'defaults' — 'defaults' alone only covers basic infrastructure, not package registries. Key ecosystem identifiers by runtime: 'dotnet' (.NET/NuGet), 'python' (pip/PyPI), 'node' (npm/yarn), 'go' (go modules), 'java' (Maven/Gradle), 'ruby' (Bundler), 'rust' (Cargo), 'swift' (Swift PM). Example: a .NET project needs network: { allowed: [defaults, dotnet] }.",
       "examples": [
         "defaults",
         {
@@ -2551,7 +2560,7 @@
       ]
     },
     "plugins": {
-      "description": "\u26a0\ufe0f  EXPERIMENTAL: Plugin configuration for installing plugins before workflow execution. Supports array format (list of repos/plugin configs) and object format (repos + custom token). Note: Plugin support is experimental and may change in future releases.",
+      "description": "⚠️  EXPERIMENTAL: Plugin configuration for installing plugins before workflow execution. Supports array format (list of repos/plugin configs) and object format (repos + custom token). Note: Plugin support is experimental and may change in future releases.",
       "examples": [
         ["github/copilot-plugin", "acme/custom-tools"],
         [
@@ -2748,7 +2757,7 @@
             [
               {
                 "name": "Verify Post-Steps Execution",
-                "run": "echo \"\u2705 Post-steps are executing correctly\"\necho \"This step runs after the AI agent completes\"\n"
+                "run": "echo \"✅ Post-steps are executing correctly\"\necho \"This step runs after the AI agent completes\"\n"
               },
               {
                 "name": "Upload Test Results",
@@ -3990,10 +3999,19 @@
                   "description": "GitHub usernames to assign the created issue to. Can be a single username string or array of usernames. Use 'copilot' to assign to GitHub Copilot."
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of issues to create (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of issues to create (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4084,10 +4102,19 @@
                   "description": "Base branch for the agent session pull request. Defaults to the current branch or repository default branch."
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of agent sessions to create (default: 1)",
-                  "minimum": 1,
-                  "maximum": 1
+                  "description": "Maximum number of agent sessions to create (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4125,10 +4152,19 @@
                   "description": "Base branch for the agent session pull request. Defaults to the current branch or repository default branch."
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of agent sessions to create (default: 1)",
-                  "minimum": 1,
-                  "maximum": 10
+                  "description": "Maximum number of agent sessions to create (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 10
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4163,10 +4199,19 @@
               "required": ["project"],
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of project operations to perform (default: 10). Each operation may add a project item, or update its fields.",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of project operations to perform (default: 10). Each operation may add a project item, or update its fields. Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -4267,10 +4312,19 @@
               "description": "Configuration for creating new GitHub Projects boards. Enables agents to create new project boards with optional custom fields, views, and an initial item. Requires a Personal Access Token (PAT) or GitHub App token with Projects write permission (default GITHUB_TOKEN cannot be used). Agent output includes: title (project name), owner (org/user login, uses default if omitted), owner_type ('org' or 'user'), optional item_url (issue to add as first item), and optional field_definitions. Returns a temporary project ID for use in subsequent update_project operations.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of create operations to perform (default: 1).",
-                  "minimum": 1,
-                  "maximum": 10
+                  "description": "Maximum number of create operations to perform (default: 1). Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 10
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -4372,10 +4426,19 @@
               "required": ["project"],
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of status updates to create (default: 1). Typically 1 per orchestrator run.",
-                  "minimum": 1,
-                  "maximum": 10
+                  "description": "Maximum number of status updates to create (default: 1). Typically 1 per orchestrator run. Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 10
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -4436,10 +4499,19 @@
                   }
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of discussions to create (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of discussions to create (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4551,10 +4623,19 @@
                   "description": "Target for closing: 'triggering' (default, current discussion), or '*' (any discussion with discussion_number field)"
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of discussions to close (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of discussions to close (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4609,10 +4690,19 @@
                   "description": "Optional list of allowed labels. If omitted, any labels are allowed (including creating new ones)."
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of discussions to update (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of discussions to update (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4655,10 +4745,19 @@
                   "description": "Target for closing: 'triggering' (default, current issue), or '*' (any issue with issue_number field)"
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of issues to close (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of issues to close (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4712,10 +4811,19 @@
                   "description": "Target for closing: 'triggering' (default, current PR), or '*' (any PR with pull_request_number field)"
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of pull requests to close (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of pull requests to close (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4771,10 +4879,19 @@
                   "description": "Target for marking: 'triggering' (default, current PR), or '*' (any PR with pull_request_number field)"
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of pull requests to mark as ready (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of pull requests to mark as ready (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -4810,10 +4927,19 @@
               "description": "Configuration for automatically creating GitHub issue or pull request comments from AI workflow output. The main job does not need write permissions.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of comments to create (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of comments to create (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": "string",
@@ -4878,11 +5004,20 @@
               "description": "Configuration for creating GitHub pull requests from agentic workflow output. Supports creating multiple PRs in a single run when max > 1.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of pull requests to create (default: 1). Each PR requires distinct changes on a separate branch.",
-                  "minimum": 1,
-                  "maximum": 10,
-                  "default": 1
+                  "description": "Maximum number of pull requests to create (default: 1). Each PR requires distinct changes on a separate branch. Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 10,
+                      "default": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "title-prefix": {
                   "type": "string",
@@ -4919,7 +5054,11 @@
                   "description": "Optional reviewer(s) to assign to the pull request. Accepts either a single string or an array of usernames. Use 'copilot' to request a code review from GitHub Copilot."
                 },
                 "draft": {
-                  "allOf": [{ "$ref": "#/$defs/templatable_boolean" }],
+                  "allOf": [
+                    {
+                      "$ref": "#/$defs/templatable_boolean"
+                    }
+                  ],
                   "description": "Whether to create pull request as draft (defaults to true). Accepts a boolean or a GitHub Actions expression.",
                   "default": true
                 },
@@ -5011,10 +5150,19 @@
               "description": "Configuration for creating GitHub pull request review comments from agentic workflow output",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of review comments to create (default: 10)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of review comments to create (default: 10) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "side": {
                   "type": "string",
@@ -5057,10 +5205,19 @@
               "description": "Configuration for submitting a consolidated PR review with a status decision (APPROVE, REQUEST_CHANGES, COMMENT). All create-pull-request-review-comment outputs are collected and submitted as part of this review.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of reviews to submit (default: 1)",
-                  "minimum": 1,
-                  "maximum": 10
+                  "description": "Maximum number of reviews to submit (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 10
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "footer": {
                   "oneOf": [
@@ -5101,10 +5258,19 @@
               "description": "Configuration for replying to existing pull request review comments",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of replies to create (default: 10)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of replies to create (default: 10) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": "string",
@@ -5144,13 +5310,22 @@
           "oneOf": [
             {
               "type": "object",
-              "description": "Configuration for resolving review threads on pull requests. Resolution is scoped to the triggering PR only \u2014 threads on other PRs cannot be resolved.",
+              "description": "Configuration for resolving review threads on pull requests. Resolution is scoped to the triggering PR only — threads on other PRs cannot be resolved.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of review threads to resolve (default: 10)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of review threads to resolve (default: 10) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -5173,9 +5348,18 @@
               "description": "Configuration for creating repository security advisories (SARIF format) from agentic workflow output",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of security findings to include (default: unlimited)",
-                  "minimum": 1
+                  "description": "Maximum number of security findings to include (default: unlimited) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "driver": {
                   "type": "string",
@@ -5202,9 +5386,18 @@
               "description": "Configuration for creating autofixes for code scanning alerts",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of autofixes to create (default: 10)",
-                  "minimum": 1
+                  "description": "Maximum number of autofixes to create (default: 10) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -5249,9 +5442,18 @@
                   "maxItems": 50
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Optional maximum number of labels to add (default: 3)",
-                  "minimum": 1
+                  "description": "Optional maximum number of labels to add (default: 3) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": "string",
@@ -5307,9 +5509,18 @@
                   "maxItems": 50
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Optional maximum number of labels to remove (default: 3)",
-                  "minimum": 1
+                  "description": "Optional maximum number of labels to remove (default: 3) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": "string",
@@ -5349,9 +5560,18 @@
                   "maxItems": 50
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Optional maximum number of reviewers to add (default: 3)",
-                  "minimum": 1
+                  "description": "Optional maximum number of reviewers to add (default: 3) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": "string",
@@ -5391,9 +5611,18 @@
                   "maxItems": 50
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Optional maximum number of milestone assignments (default: 1)",
-                  "minimum": 1
+                  "description": "Optional maximum number of milestone assignments (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -5443,9 +5672,18 @@
                   "description": "Optional list of allowed agent names. If specified, only these agents can be assigned. When configured, existing agent assignees not in the list are removed while regular user assignees are preserved."
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Optional maximum number of agent assignments (default: 1)",
-                  "minimum": 1
+                  "description": "Optional maximum number of agent assignments (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": ["string", "number"],
@@ -5510,9 +5748,18 @@
                   "description": "Optional list of blocked usernames or patterns (e.g., 'copilot', '*[bot]'). Users matching these patterns cannot be assigned. Supports exact matches and glob patterns."
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Optional maximum number of user assignments (default: 1)",
-                  "minimum": 1
+                  "description": "Optional maximum number of user assignments (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": ["string", "number"],
@@ -5562,9 +5809,18 @@
                   "description": "Optional list of blocked usernames or patterns (e.g., 'copilot', '*[bot]'). Users matching these patterns cannot be unassigned. Supports exact matches and glob patterns."
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Optional maximum number of unassignment operations (default: 1)",
-                  "minimum": 1
+                  "description": "Optional maximum number of unassignment operations (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target": {
                   "type": ["string", "number"],
@@ -5602,10 +5858,19 @@
               "description": "Configuration for linking issues as sub-issues from agentic workflow output",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of sub-issue links to create (default: 5)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of sub-issue links to create (default: 5) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "parent-required-labels": {
                   "type": "array",
@@ -5676,10 +5941,19 @@
                   "default": true
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of issues to update (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of issues to update (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -5728,10 +6002,19 @@
                   "default": true
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of pull requests to update (default: 1)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of pull requests to update (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -5762,11 +6045,20 @@
               "description": "Configuration for pushing changes to a specific branch from agentic workflow output. Supports pushing to multiple PRs in a single run when max > 1.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of push operations to perform (default: 1). Each push targets a different pull request branch.",
-                  "minimum": 1,
-                  "maximum": 10,
-                  "default": 1
+                  "description": "Maximum number of push operations to perform (default: 1). Each push targets a different pull request branch. Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 10,
+                      "default": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "branch": {
                   "type": "string",
@@ -5822,10 +6114,19 @@
               "description": "Configuration for hiding comments on GitHub issues, pull requests, or discussions from agentic workflow output",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of comments to hide (default: 5)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of comments to hide (default: 5) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -5866,11 +6167,20 @@
                   "maxItems": 50
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of workflow dispatch operations per run (default: 1, max: 50)",
-                  "minimum": 1,
-                  "maximum": 50,
-                  "default": 1
+                  "description": "Maximum number of workflow dispatch operations per run (default: 1, max: 50) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 50,
+                      "default": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -5900,9 +6210,18 @@
               "description": "Configuration for reporting missing tools from agentic workflow output",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of missing tool reports (default: unlimited)",
-                  "minimum": 1
+                  "description": "Maximum number of missing tool reports (default: unlimited) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "create-issue": {
                   "type": "boolean",
@@ -5948,9 +6267,18 @@
               "description": "Configuration for reporting missing data required to achieve workflow goals. Encourages AI agents to be truthful about data gaps instead of hallucinating information.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of missing data reports (default: unlimited)",
-                  "minimum": 1
+                  "description": "Maximum number of missing data reports (default: unlimited) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "create-issue": {
                   "type": "boolean",
@@ -5996,10 +6324,19 @@
               "description": "Configuration for no-op safe output (logging only, no GitHub API calls). Always available as a fallback to ensure human-visible artifacts.",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of noop messages (default: 1)",
-                  "minimum": 1,
-                  "default": 1
+                  "description": "Maximum number of noop messages (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "default": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -6052,10 +6389,19 @@
                   }
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of assets to upload (default: 10)",
-                  "minimum": 1,
-                  "maximum": 100
+                  "description": "Maximum number of assets to upload (default: 10) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 100
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "github-token": {
                   "$ref": "#/$defs/github_token",
@@ -6078,11 +6424,20 @@
               "description": "Configuration for updating GitHub release descriptions",
               "properties": {
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of releases to update (default: 1)",
-                  "minimum": 1,
-                  "maximum": 10,
-                  "default": 1
+                  "description": "Maximum number of releases to update (default: 1) Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 10,
+                      "default": 1
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 },
                 "target-repo": {
                   "type": "string",
@@ -6367,8 +6722,8 @@
             },
             "staged-title": {
               "type": "string",
-              "description": "Custom title template for staged mode preview. Available placeholders: {operation}. Example: '\ud83c\udfad Preview: {operation}'",
-              "examples": ["\ud83c\udfad Preview: {operation}", "## Staged Mode: {operation}"]
+              "description": "Custom title template for staged mode preview. Available placeholders: {operation}. Example: '🎭 Preview: {operation}'",
+              "examples": ["🎭 Preview: {operation}", "## Staged Mode: {operation}"]
             },
             "staged-description": {
               "type": "string",
@@ -6382,18 +6737,18 @@
             },
             "run-success": {
               "type": "string",
-              "description": "Custom message template for successful workflow completion. Available placeholders: {workflow_name}, {run_url}. Default: '\u2705 Agentic [{workflow_name}]({run_url}) completed successfully.'",
-              "examples": ["\u2705 Agentic [{workflow_name}]({run_url}) completed successfully.", "\u2705 [{workflow_name}]({run_url}) finished."]
+              "description": "Custom message template for successful workflow completion. Available placeholders: {workflow_name}, {run_url}. Default: '✅ Agentic [{workflow_name}]({run_url}) completed successfully.'",
+              "examples": ["✅ Agentic [{workflow_name}]({run_url}) completed successfully.", "✅ [{workflow_name}]({run_url}) finished."]
             },
             "run-failure": {
               "type": "string",
-              "description": "Custom message template for failed workflow. Available placeholders: {workflow_name}, {run_url}, {status}. Default: '\u274c Agentic [{workflow_name}]({run_url}) {status} and wasn't able to produce a result.'",
-              "examples": ["\u274c Agentic [{workflow_name}]({run_url}) {status} and wasn't able to produce a result.", "\u274c [{workflow_name}]({run_url}) {status}."]
+              "description": "Custom message template for failed workflow. Available placeholders: {workflow_name}, {run_url}, {status}. Default: '❌ Agentic [{workflow_name}]({run_url}) {status} and wasn't able to produce a result.'",
+              "examples": ["❌ Agentic [{workflow_name}]({run_url}) {status} and wasn't able to produce a result.", "❌ [{workflow_name}]({run_url}) {status}."]
             },
             "detection-failure": {
               "type": "string",
-              "description": "Custom message template for detection job failure. Available placeholders: {workflow_name}, {run_url}. Default: '\u26a0\ufe0f Security scanning failed for [{workflow_name}]({run_url}). Review the logs for details.'",
-              "examples": ["\u26a0\ufe0f Security scanning failed for [{workflow_name}]({run_url}). Review the logs for details.", "\u26a0\ufe0f Detection job failed in [{workflow_name}]({run_url})."]
+              "description": "Custom message template for detection job failure. Available placeholders: {workflow_name}, {run_url}. Default: '⚠️ Security scanning failed for [{workflow_name}]({run_url}). Review the logs for details.'",
+              "examples": ["⚠️ Security scanning failed for [{workflow_name}]({run_url}). Review the logs for details.", "⚠️ Detection job failed in [{workflow_name}]({run_url})."]
             },
             "agent-failure-issue": {
               "type": "string",
@@ -6443,10 +6798,19 @@
                   }
                 },
                 "max": {
-                  "type": "integer",
-                  "description": "Maximum number of mentions allowed per message. Default: 50",
-                  "minimum": 1,
-                  "default": 50
+                  "description": "Maximum number of mentions allowed per message. Default: 50 Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+                  "oneOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 1,
+                      "default": 50
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "^\\$\\{\\{.*\\}\\}$",
+                      "description": "GitHub Actions expression that resolves to an integer at runtime"
+                    }
+                  ]
                 }
               },
               "additionalProperties": false
@@ -6509,10 +6873,19 @@
       "required": ["max"],
       "properties": {
         "max": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 10,
-          "description": "Maximum number of workflow runs allowed per user within the time window. Required field."
+          "description": "Maximum number of workflow runs allowed per user within the time window. Required field. Supports integer or GitHub Actions expression (e.g. '${{ inputs.max }}').",
+          "oneOf": [
+            {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 10
+            },
+            {
+              "type": "string",
+              "pattern": "^\\$\\{\\{.*\\}\\}$",
+              "description": "GitHub Actions expression that resolves to an integer at runtime"
+            }
+          ]
         },
         "window": {
           "type": "integer",
@@ -6874,6 +7247,20 @@
         }
       ]
     },
+    "templatable_integer": {
+      "description": "A non-negative integer value that may also be specified as a GitHub Actions expression string that resolves to an integer at runtime (e.g. '${{ inputs.max-issues }}').",
+      "oneOf": [
+        {
+          "type": "integer",
+          "minimum": 0
+        },
+        {
+          "type": "string",
+          "pattern": "^\\$\\{\\{.*\\}\\}$",
+          "description": "GitHub Actions expression that resolves to an integer at runtime"
+        }
+      ]
+    },
     "engine_config": {
       "examples": [
         "claude",
diff --git a/pkg/workflow/add_comment.go b/pkg/workflow/add_comment.go
index c2a853feda..d8be285198 100644
--- a/pkg/workflow/add_comment.go
+++ b/pkg/workflow/add_comment.go
@@ -158,6 +158,12 @@ func (c *Compiler) parseCommentsConfig(outputMap map[string]any) *AddCommentsCon
 		return nil
 	}
 
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", addCommentLog); err != nil {
+		addCommentLog.Printf("Invalid max value: %v", err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config AddCommentsConfig
 	if err := unmarshalConfig(outputMap, "add-comment", &config, addCommentLog); err != nil {
@@ -167,8 +173,8 @@ func (c *Compiler) parseCommentsConfig(outputMap map[string]any) *AddCommentsCon
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 	}
 
 	// Validate target-repo (wildcard "*" is not allowed)
diff --git a/pkg/workflow/add_reviewer.go b/pkg/workflow/add_reviewer.go
index 6adfab3356..243d734689 100644
--- a/pkg/workflow/add_reviewer.go
+++ b/pkg/workflow/add_reviewer.go
@@ -22,6 +22,15 @@ func (c *Compiler) parseAddReviewerConfig(outputMap map[string]any) *AddReviewer
 
 	addReviewerLog.Print("Parsing add-reviewer configuration")
 
+	// Get config data for pre-processing before YAML unmarshaling
+	configData, _ := outputMap["add-reviewer"].(map[string]any)
+
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", addReviewerLog); err != nil {
+		addReviewerLog.Printf("Invalid max value: %v", err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config AddReviewerConfig
 	if err := unmarshalConfig(outputMap, "add-reviewer", &config, addReviewerLog); err != nil {
@@ -31,8 +40,8 @@ func (c *Compiler) parseAddReviewerConfig(outputMap map[string]any) *AddReviewer
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 3
+	if config.Max == nil {
+		config.Max = defaultIntStr(3)
 	}
 
 	// Validate target-repo (wildcard "*" is not allowed for safe outputs)
diff --git a/pkg/workflow/assign_to_agent.go b/pkg/workflow/assign_to_agent.go
index 2e5ca7207c..d6ebe822b2 100644
--- a/pkg/workflow/assign_to_agent.go
+++ b/pkg/workflow/assign_to_agent.go
@@ -30,6 +30,15 @@ func (c *Compiler) parseAssignToAgentConfig(outputMap map[string]any) *AssignToA
 
 	assignToAgentLog.Print("Parsing assign-to-agent configuration")
 
+	// Get config data for pre-processing before YAML unmarshaling
+	configData, _ := outputMap["assign-to-agent"].(map[string]any)
+
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", assignToAgentLog); err != nil {
+		assignToAgentLog.Printf("Invalid max value: %v", err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config AssignToAgentConfig
 	if err := unmarshalConfig(outputMap, "assign-to-agent", &config, assignToAgentLog); err != nil {
@@ -39,12 +48,12 @@ func (c *Compiler) parseAssignToAgentConfig(outputMap map[string]any) *AssignToA
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 	}
 
-	assignToAgentLog.Printf("Parsed assign-to-agent config: default_agent=%s, default_model=%s, default_custom_agent=%s, allowed_count=%d, target=%s, max=%d, pull_request_repo=%s, base_branch=%s",
-		config.DefaultAgent, config.DefaultModel, config.DefaultCustomAgent, len(config.Allowed), config.Target, config.Max, config.PullRequestRepoSlug, config.BaseBranch)
+	assignToAgentLog.Printf("Parsed assign-to-agent config: default_agent=%s, default_model=%s, default_custom_agent=%s, allowed_count=%d, target=%s, max=%s, pull_request_repo=%s, base_branch=%s",
+		config.DefaultAgent, config.DefaultModel, config.DefaultCustomAgent, len(config.Allowed), config.Target, *config.Max, config.PullRequestRepoSlug, config.BaseBranch)
 
 	return &config
 }
diff --git a/pkg/workflow/assign_to_user.go b/pkg/workflow/assign_to_user.go
index 79fcaf70b4..7933060e01 100644
--- a/pkg/workflow/assign_to_user.go
+++ b/pkg/workflow/assign_to_user.go
@@ -33,6 +33,12 @@ func (c *Compiler) parseAssignToUserConfig(outputMap map[string]any) *AssignToUs
 		return nil
 	}
 
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", assignToUserLog); err != nil {
+		assignToUserLog.Printf("Invalid max value: %v", err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config AssignToUserConfig
 	if err := unmarshalConfig(outputMap, "assign-to-user", &config, assignToUserLog); err != nil {
@@ -40,13 +46,13 @@ func (c *Compiler) parseAssignToUserConfig(outputMap map[string]any) *AssignToUs
 		// For backward compatibility, use defaults
 		assignToUserLog.Print("Using default configuration")
 		config = AssignToUserConfig{
-			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: defaultIntStr(1)},
 		}
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 	}
 
 	assignToUserLog.Printf("Parsed configuration: allowed_count=%d, target=%s", len(config.Allowed), config.Target)
diff --git a/pkg/workflow/autofix_code_scanning_alert.go b/pkg/workflow/autofix_code_scanning_alert.go
index 601997c908..7e58f183cf 100644
--- a/pkg/workflow/autofix_code_scanning_alert.go
+++ b/pkg/workflow/autofix_code_scanning_alert.go
@@ -16,7 +16,7 @@ func (c *Compiler) parseAutofixCodeScanningAlertConfig(outputMap map[string]any)
 	if configData, exists := outputMap["autofix-code-scanning-alert"]; exists {
 		autofixCodeScanningAlertLog.Print("Parsing autofix-code-scanning-alert configuration")
 		addCodeScanningAutofixConfig := &AutofixCodeScanningAlertConfig{}
-		addCodeScanningAutofixConfig.Max = 10 // Default max is 10
+		addCodeScanningAutofixConfig.Max = defaultIntStr(10) // Default max is 10
 
 		if configMap, ok := configData.(map[string]any); ok {
 			// Parse common base fields with default max of 10
diff --git a/pkg/workflow/claude_engine_test.go b/pkg/workflow/claude_engine_test.go
index 348cc31ccb..5ed7476a11 100644
--- a/pkg/workflow/claude_engine_test.go
+++ b/pkg/workflow/claude_engine_test.go
@@ -433,7 +433,7 @@ func TestClaudeEngineWithSafeOutputs(t *testing.T) {
 		Tools: map[string]any{},
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 			},
 		},
 	}
diff --git a/pkg/workflow/claude_engine_tools_test.go b/pkg/workflow/claude_engine_tools_test.go
index e18779c9ab..fbf142b5ae 100644
--- a/pkg/workflow/claude_engine_tools_test.go
+++ b/pkg/workflow/claude_engine_tools_test.go
@@ -349,7 +349,7 @@ func TestClaudeEngineComputeAllowedToolsWithSafeOutputs(t *testing.T) {
 				// Using neutral tools instead of claude section
 			},
 			safeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			},
 			expected: "ExitPlanMode,Glob,Grep,LS,NotebookRead,Read,Task,TodoWrite,Write",
 		},
@@ -359,7 +359,7 @@ func TestClaudeEngineComputeAllowedToolsWithSafeOutputs(t *testing.T) {
 				"edit": nil, // This provides Write capabilities
 			},
 			safeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			},
 			expected: "Edit,ExitPlanMode,Glob,Grep,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,Write",
 		},
@@ -378,9 +378,9 @@ func TestClaudeEngineComputeAllowedToolsWithSafeOutputs(t *testing.T) {
 				"edit": nil,
 			},
 			safeOutputs: &SafeOutputsConfig{
-				CreateIssues:       &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
-				AddComments:        &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
-				CreatePullRequests: &CreatePullRequestsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreateIssues:       &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
+				AddComments:        &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
+				CreatePullRequests: &CreatePullRequestsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			},
 			expected: "Bash,BashOutput,Edit,ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,Write",
 		},
@@ -392,7 +392,7 @@ func TestClaudeEngineComputeAllowedToolsWithSafeOutputs(t *testing.T) {
 				},
 			},
 			safeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			},
 			expected: "ExitPlanMode,Glob,Grep,LS,NotebookRead,Read,Task,TodoWrite,Write,mcp__github__create_issue,mcp__github__create_pull_request",
 		},
@@ -404,7 +404,7 @@ func TestClaudeEngineComputeAllowedToolsWithSafeOutputs(t *testing.T) {
 				"edit":      nil,
 			},
 			safeOutputs: &SafeOutputsConfig{
-				CreatePullRequests: &CreatePullRequestsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreatePullRequests: &CreatePullRequestsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			},
 			expected: "Bash(echo),Bash(ls),BashOutput,Edit,ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,WebFetch,Write",
 		},
diff --git a/pkg/workflow/close_entity_helpers.go b/pkg/workflow/close_entity_helpers.go
index 70e79624bd..a9f2399390 100644
--- a/pkg/workflow/close_entity_helpers.go
+++ b/pkg/workflow/close_entity_helpers.go
@@ -95,6 +95,15 @@ func (c *Compiler) parseCloseEntityConfig(outputMap map[string]any, params Close
 
 	logger.Printf("Parsing %s configuration", params.ConfigKey)
 
+	// Get config data for pre-processing before YAML unmarshaling
+	configData, _ := outputMap[params.ConfigKey].(map[string]any)
+
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", logger); err != nil {
+		logger.Printf("Invalid max value for %s: %v", params.ConfigKey, err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config CloseEntityConfig
 	if err := unmarshalConfig(outputMap, params.ConfigKey, &config, logger); err != nil {
@@ -104,8 +113,8 @@ func (c *Compiler) parseCloseEntityConfig(outputMap map[string]any, params Close
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 		logger.Printf("Set default max to 1 for %s", params.ConfigKey)
 	}
 
@@ -115,7 +124,7 @@ func (c *Compiler) parseCloseEntityConfig(outputMap map[string]any, params Close
 		return nil
 	}
 
-	logger.Printf("Parsed %s configuration: max=%d, target=%s", params.ConfigKey, config.Max, config.Target)
+	logger.Printf("Parsed %s configuration: max=%s, target=%s", params.ConfigKey, *config.Max, config.Target)
 
 	return &config
 }
diff --git a/pkg/workflow/compile_config_test.go b/pkg/workflow/compile_config_test.go
index 90935190d4..f6d7471308 100644
--- a/pkg/workflow/compile_config_test.go
+++ b/pkg/workflow/compile_config_test.go
@@ -344,8 +344,8 @@ func TestCreateDiscussionConfigParsing(t *testing.T) {
 				t.Errorf("Expected category %q, but got %q", tt.expectedCategory, discussionConfig.Category)
 			}
 
-			if discussionConfig.Max != tt.expectedMax {
-				t.Errorf("Expected max %d, but got %d", tt.expectedMax, discussionConfig.Max)
+			if templatableIntValue(discussionConfig.Max) != tt.expectedMax {
+				t.Errorf("Expected max %d, but got %v", tt.expectedMax, discussionConfig.Max)
 			}
 		})
 	}
diff --git a/pkg/workflow/compile_outputs_comment_test.go b/pkg/workflow/compile_outputs_comment_test.go
index c35a53e5ef..805d8d87a2 100644
--- a/pkg/workflow/compile_outputs_comment_test.go
+++ b/pkg/workflow/compile_outputs_comment_test.go
@@ -213,8 +213,8 @@ This workflow tests the add-comment max and target configuration parsing.
 		t.Fatal("Expected issue_comment configuration to be parsed")
 	}
 
-	if workflowData.SafeOutputs.AddComments.Max != 3 {
-		t.Fatalf("Expected max to be 3, got %d", workflowData.SafeOutputs.AddComments.Max)
+	if templatableIntValue(workflowData.SafeOutputs.AddComments.Max) != 3 {
+		t.Fatalf("Expected max to be 3, got %v", workflowData.SafeOutputs.AddComments.Max)
 	}
 
 	if workflowData.SafeOutputs.AddComments.Target != "123" {
diff --git a/pkg/workflow/compile_outputs_issue_test.go b/pkg/workflow/compile_outputs_issue_test.go
index 1235d06e63..7958b3e40f 100644
--- a/pkg/workflow/compile_outputs_issue_test.go
+++ b/pkg/workflow/compile_outputs_issue_test.go
@@ -198,8 +198,8 @@ This workflow tests the null output configuration parsing.
 	if len(workflowData.SafeOutputs.AddLabels.Allowed) != 0 {
 		t.Errorf("Expected empty allowed labels for null add-labels, got %v", workflowData.SafeOutputs.AddLabels.Allowed)
 	}
-	if workflowData.SafeOutputs.AddLabels.Max != 0 {
-		t.Errorf("Expected Max to be 0 for null add-labels, got %v", workflowData.SafeOutputs.AddLabels.Max)
+	if workflowData.SafeOutputs.AddLabels.Max != nil {
+		t.Errorf("Expected Max to be nil for null add-labels, got %v", workflowData.SafeOutputs.AddLabels.Max)
 	}
 }
 
diff --git a/pkg/workflow/compile_outputs_label_test.go b/pkg/workflow/compile_outputs_label_test.go
index 7864a65292..c92efe7a1c 100644
--- a/pkg/workflow/compile_outputs_label_test.go
+++ b/pkg/workflow/compile_outputs_label_test.go
@@ -402,9 +402,9 @@ This workflow tests the output labels null configuration parsing.
 		t.Errorf("Expected 0 allowed labels for null config, got %d", len(workflowData.SafeOutputs.AddLabels.Allowed))
 	}
 
-	// Verify max is 0 (will use default)
-	if workflowData.SafeOutputs.AddLabels.Max != 0 {
-		t.Errorf("Expected max to be 0 for null config, got %d", workflowData.SafeOutputs.AddLabels.Max)
+	// Verify max is nil (will use default)
+	if workflowData.SafeOutputs.AddLabels.Max != nil {
+		t.Errorf("Expected max to be nil for null config, got %v", workflowData.SafeOutputs.AddLabels.Max)
 	}
 }
 
@@ -472,8 +472,8 @@ This workflow tests the output labels max configuration parsing.
 
 	// Verify max
 	expectedMaxCount := 5
-	if workflowData.SafeOutputs.AddLabels.Max != expectedMaxCount {
-		t.Errorf("Expected max to be %d, got %d", expectedMaxCount, workflowData.SafeOutputs.AddLabels.Max)
+	if templatableIntValue(workflowData.SafeOutputs.AddLabels.Max) != expectedMaxCount {
+		t.Errorf("Expected max to be %d, got %v", expectedMaxCount, workflowData.SafeOutputs.AddLabels.Max)
 	}
 }
 
@@ -517,9 +517,9 @@ This workflow tests the default max behavior.
 		t.Fatalf("Unexpected error parsing workflow without max: %v", err)
 	}
 
-	// Verify max is 0 (will use default in job generation)
-	if workflowData.SafeOutputs.AddLabels.Max != 0 {
-		t.Errorf("Expected max to be 0 (default), got %d", workflowData.SafeOutputs.AddLabels.Max)
+	// Verify max is nil (will use default in job generation)
+	if workflowData.SafeOutputs.AddLabels.Max != nil {
+		t.Errorf("Expected max to be nil (default), got %v", workflowData.SafeOutputs.AddLabels.Max)
 	}
 }
 
diff --git a/pkg/workflow/compiler_safe_outputs_config.go b/pkg/workflow/compiler_safe_outputs_config.go
index 2d3aa7b5e4..f4e16d73b2 100644
--- a/pkg/workflow/compiler_safe_outputs_config.go
+++ b/pkg/workflow/compiler_safe_outputs_config.go
@@ -139,7 +139,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CreateIssues
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed_labels", c.AllowedLabels).
 			AddStringSlice("allowed_repos", c.AllowedRepos).
 			AddIfPositive("expires", c.Expires).
@@ -158,7 +158,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.AddComments
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddTemplatableBool("hide_older_comments", c.HideOlderComments).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
@@ -171,7 +171,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CreateDiscussions
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("category", c.Category).
 			AddIfNotEmpty("title_prefix", c.TitlePrefix).
 			AddStringSlice("labels", c.Labels).
@@ -191,7 +191,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CloseIssues
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddStringSlice("required_labels", c.RequiredLabels).
 			AddIfNotEmpty("required_title_prefix", c.RequiredTitlePrefix).
@@ -205,7 +205,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CloseDiscussions
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddStringSlice("required_labels", c.RequiredLabels).
 			AddIfNotEmpty("required_title_prefix", c.RequiredTitlePrefix).
@@ -219,7 +219,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.AddLabels
 		config := newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed", c.Allowed).
 			AddStringSlice("blocked", c.Blocked).
 			AddIfNotEmpty("target", c.Target).
@@ -241,7 +241,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.RemoveLabels
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed", c.Allowed).
 			AddStringSlice("blocked", c.Blocked).
 			AddIfNotEmpty("target", c.Target).
@@ -255,7 +255,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.AddReviewer
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed", c.Reviewers).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
@@ -268,7 +268,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.AssignMilestone
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed", c.Allowed).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
@@ -281,7 +281,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.MarkPullRequestAsReadyForReview
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddStringSlice("required_labels", c.RequiredLabels).
 			AddIfNotEmpty("required_title_prefix", c.RequiredTitlePrefix).
@@ -295,7 +295,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CreateCodeScanningAlerts
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("driver", c.Driver).
 			Build()
 	},
@@ -305,7 +305,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CreateAgentSessions
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("base", c.Base).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
 			AddStringSlice("allowed_repos", c.AllowedRepos).
@@ -317,7 +317,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.UpdateIssues
 		builder := newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("title_prefix", c.TitlePrefix)
 		// Boolean pointer fields indicate which fields can be updated
@@ -341,7 +341,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.UpdateDiscussions
 		builder := newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target)
 		// Boolean pointer fields indicate which fields can be updated
 		if c.Title != nil {
@@ -366,7 +366,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.LinkSubIssue
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("parent_required_labels", c.ParentRequiredLabels).
 			AddIfNotEmpty("parent_title_prefix", c.ParentTitlePrefix).
 			AddStringSlice("sub_required_labels", c.SubRequiredLabels).
@@ -381,7 +381,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.UpdateRelease
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddTemplatableBool("footer", getEffectiveFooterForTemplatable(c.Footer, cfg.Footer)).
 			Build()
 	},
@@ -391,7 +391,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CreatePullRequestReviewComments
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("side", c.Side).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
@@ -404,7 +404,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.SubmitPullRequestReview
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddStringPtr("footer", getEffectiveFooterString(c.Footer, cfg.Footer)).
 			Build()
@@ -415,7 +415,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.ReplyToPullRequestReviewComment
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
 			AddStringSlice("allowed_repos", c.AllowedRepos).
@@ -428,7 +428,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.ResolvePullRequestReviewThread
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			Build()
 	},
 	"create_pull_request": func(cfg *SafeOutputsConfig) map[string]any {
@@ -441,7 +441,7 @@ var handlerRegistry = map[string]handlerBuilder{
 			maxPatchSize = cfg.MaximumPatchSize
 		}
 		builder := newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("title_prefix", c.TitlePrefix).
 			AddStringSlice("labels", c.Labels).
 			AddStringSlice("reviewers", c.Reviewers).
@@ -474,7 +474,7 @@ var handlerRegistry = map[string]handlerBuilder{
 			maxPatchSize = cfg.MaximumPatchSize
 		}
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("title_prefix", c.TitlePrefix).
 			AddStringSlice("labels", c.Labels).
@@ -490,7 +490,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.UpdatePullRequests
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddBoolPtrOrDefault("allow_title", c.Title, true).
 			AddBoolPtrOrDefault("allow_body", c.Body, true).
@@ -506,7 +506,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.ClosePullRequests
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target", c.Target).
 			AddStringSlice("required_labels", c.RequiredLabels).
 			AddIfNotEmpty("required_title_prefix", c.RequiredTitlePrefix).
@@ -520,7 +520,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.HideComment
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed_reasons", c.AllowedReasons).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
 			AddStringSlice("allowed_repos", c.AllowedRepos).
@@ -532,7 +532,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.DispatchWorkflow
 		builder := newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("workflows", c.Workflows)
 
 		// Add workflow_files map if it has entries
@@ -548,7 +548,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.MissingTool
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			Build()
 	},
 	"missing_data": func(cfg *SafeOutputsConfig) map[string]any {
@@ -557,7 +557,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.MissingData
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			Build()
 	},
 	// Note: "noop" is intentionally NOT included here because it is always processed
@@ -569,7 +569,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.AutofixCodeScanningAlert
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("github-token", c.GitHubToken).
 			Build()
 	},
@@ -581,7 +581,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CreateProjects
 		builder := newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("target_owner", c.TargetOwner).
 			AddIfNotEmpty("title_prefix", c.TitlePrefix).
 			AddIfNotEmpty("github-token", c.GitHubToken)
@@ -599,7 +599,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.UpdateProjects
 		builder := newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("github-token", c.GitHubToken).
 			AddIfNotEmpty("project", c.Project)
 		if len(c.Views) > 0 {
@@ -616,7 +616,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.AssignToUser
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed", c.Allowed).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
@@ -630,7 +630,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.UnassignFromUser
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddStringSlice("allowed", c.Allowed).
 			AddIfNotEmpty("target", c.Target).
 			AddIfNotEmpty("target-repo", c.TargetRepoSlug).
@@ -643,7 +643,7 @@ var handlerRegistry = map[string]handlerBuilder{
 		}
 		c := cfg.CreateProjectStatusUpdates
 		return newHandlerConfigBuilder().
-			AddIfPositive("max", c.Max).
+			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("github-token", c.GitHubToken).
 			AddIfNotEmpty("project", c.Project).
 			Build()
diff --git a/pkg/workflow/compiler_safe_outputs_config_test.go b/pkg/workflow/compiler_safe_outputs_config_test.go
index 15f87699d7..54baa4d94a 100644
--- a/pkg/workflow/compiler_safe_outputs_config_test.go
+++ b/pkg/workflow/compiler_safe_outputs_config_test.go
@@ -25,7 +25,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 					AllowedLabels: []string{"bug", "feature"},
 					Labels:        []string{"ai-generated"},
@@ -44,7 +44,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				AddComments: &AddCommentsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 3,
+						Max: strPtr("3"),
 					},
 					Target:            "issue",
 					HideOlderComments: testStringPtr("true"),
@@ -61,7 +61,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				CreateDiscussions: &CreateDiscussionsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 2,
+						Max: strPtr("2"),
 					},
 					Category:              "general",
 					TitlePrefix:           "[Discussion] ",
@@ -80,7 +80,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				CloseIssues: &CloseEntityConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 10,
+						Max: strPtr("10"),
 					},
 				},
 			},
@@ -109,7 +109,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 				UpdateIssues: &UpdateIssuesConfig{
 					UpdateEntityConfig: UpdateEntityConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 5,
+							Max: strPtr("5"),
 						},
 					},
 					Status: testBoolPtr(true),
@@ -128,7 +128,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequests: &CreatePullRequestsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 3,
+						Max: strPtr("3"),
 					},
 					TitlePrefix: "[PR] ",
 					Labels:      []string{"automated"},
@@ -149,7 +149,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequests: &CreatePullRequestsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 1,
+						Max: strPtr("1"),
 					},
 					Reviewers: []string{"user1", "user2"},
 					Labels:    []string{"automated"},
@@ -167,7 +167,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				PushToPullRequestBranch: &PushToPullRequestBranchConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 					Target:            "pull_request",
 					TitlePrefix:       "[Update] ",
@@ -190,7 +190,7 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 				},
 				AddComments: &AddCommentsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 3,
+						Max: strPtr("3"),
 					},
 				},
 				AddLabels: &AddLabelsConfig{
@@ -289,7 +289,7 @@ func TestHandlerConfigMaxValues(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 10,
+					Max: strPtr("10"),
 				},
 			},
 		},
@@ -721,7 +721,7 @@ func TestAutoEnabledHandlers(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				MissingTool: &MissingToolConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 			},
@@ -732,7 +732,7 @@ func TestAutoEnabledHandlers(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				MissingData: &MissingDataConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 			},
@@ -743,12 +743,12 @@ func TestAutoEnabledHandlers(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				MissingTool: &MissingToolConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 				MissingData: &MissingDataConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 			},
@@ -762,7 +762,7 @@ func TestAutoEnabledHandlers(t *testing.T) {
 				},
 				MissingTool: &MissingToolConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 			},
@@ -842,7 +842,7 @@ func TestCreatePullRequestBaseBranch(t *testing.T) {
 				SafeOutputs: &SafeOutputsConfig{
 					CreatePullRequests: &CreatePullRequestsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 1,
+							Max: strPtr("1"),
 						},
 						BaseBranch: tt.baseBranch,
 					},
@@ -890,7 +890,7 @@ func TestHandlerConfigAssignToUser(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AssignToUser: &AssignToUserConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 5,
+					Max: strPtr("5"),
 				},
 				SafeOutputTargetConfig: SafeOutputTargetConfig{
 					Target:         "issues",
@@ -970,7 +970,7 @@ func TestHandlerConfigAssignToUserWithUnassignFirst(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AssignToUser: &AssignToUserConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 3,
+					Max: strPtr("3"),
 				},
 				UnassignFirst: testStringPtr("true"),
 			},
@@ -1019,7 +1019,7 @@ func TestHandlerConfigUnassignFromUser(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			UnassignFromUser: &UnassignFromUserConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 10,
+					Max: strPtr("10"),
 				},
 				SafeOutputTargetConfig: SafeOutputTargetConfig{
 					Target:         "issues",
diff --git a/pkg/workflow/compiler_safe_outputs_env_copilot_test.go b/pkg/workflow/compiler_safe_outputs_env_copilot_test.go
index fb64d8a644..bf8dbfc2b1 100644
--- a/pkg/workflow/compiler_safe_outputs_env_copilot_test.go
+++ b/pkg/workflow/compiler_safe_outputs_env_copilot_test.go
@@ -18,7 +18,7 @@ func TestCopilotAssignmentEnvVarIsSet(t *testing.T) {
 		Name: "Test",
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Assignees:            []string{"copilot"},
 			},
 		},
@@ -43,7 +43,7 @@ func TestCopilotAssignmentEnvVarNotSetWithoutCopilot(t *testing.T) {
 		Name: "Test",
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Assignees:            []string{"user1"},
 			},
 		},
@@ -67,7 +67,7 @@ func TestCopilotAssignmentEnvVarWithMixedAssignees(t *testing.T) {
 		Name: "Test",
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Assignees:            []string{"user1", "copilot", "user2"},
 			},
 		},
@@ -92,7 +92,7 @@ func TestCopilotAssignmentEnvVarWithNilAssignees(t *testing.T) {
 		Name: "Test",
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Assignees:            nil,
 			},
 		},
@@ -116,7 +116,7 @@ func TestCopilotAssignmentEnvVarWithEmptyAssignees(t *testing.T) {
 		Name: "Test",
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Assignees:            []string{},
 			},
 		},
diff --git a/pkg/workflow/compiler_safe_outputs_env_test.go b/pkg/workflow/compiler_safe_outputs_env_test.go
index bdab3b9fbb..90c4157df8 100644
--- a/pkg/workflow/compiler_safe_outputs_env_test.go
+++ b/pkg/workflow/compiler_safe_outputs_env_test.go
@@ -49,7 +49,7 @@ func TestAddAllSafeOutputConfigEnvVars(t *testing.T) {
 				Staged: true,
 				AddComments: &AddCommentsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 			},
@@ -110,7 +110,7 @@ func TestAddAllSafeOutputConfigEnvVars(t *testing.T) {
 				},
 				AddComments: &AddCommentsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 3,
+						Max: strPtr("3"),
 					},
 				},
 			},
@@ -187,7 +187,7 @@ func TestStagedFlagOnlyAddedOnce(t *testing.T) {
 			},
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 3,
+					Max: strPtr("3"),
 				},
 			},
 			AddLabels: &AddLabelsConfig{
@@ -307,7 +307,7 @@ func TestEnvVarsWithMultipleSafeOutputTypes(t *testing.T) {
 			},
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 3,
+					Max: strPtr("3"),
 				},
 			},
 			AddLabels: &AddLabelsConfig{
@@ -346,7 +346,7 @@ func TestEnvVarsWithNoStagedConfig(t *testing.T) {
 			},
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 5,
+					Max: strPtr("5"),
 				},
 			},
 		},
@@ -475,7 +475,7 @@ func TestAddCommentsTargetRepoStagedBehavior(t *testing.T) {
 			AddComments: &AddCommentsConfig{
 				TargetRepoSlug: "org/target",
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 5,
+					Max: strPtr("5"),
 				},
 			},
 		},
diff --git a/pkg/workflow/compiler_safe_outputs_job_test.go b/pkg/workflow/compiler_safe_outputs_job_test.go
index 7fe3b8f6cd..1b52c62337 100644
--- a/pkg/workflow/compiler_safe_outputs_job_test.go
+++ b/pkg/workflow/compiler_safe_outputs_job_test.go
@@ -46,7 +46,7 @@ func TestBuildConsolidatedSafeOutputsJob(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				AddComments: &AddCommentsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 			},
@@ -74,7 +74,7 @@ func TestBuildConsolidatedSafeOutputsJob(t *testing.T) {
 				},
 				AddComments: &AddCommentsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 3,
+						Max: strPtr("3"),
 					},
 				},
 				AddLabels: &AddLabelsConfig{
diff --git a/pkg/workflow/compiler_safe_outputs_specialized.go b/pkg/workflow/compiler_safe_outputs_specialized.go
index a83fda8085..ef89a52360 100644
--- a/pkg/workflow/compiler_safe_outputs_specialized.go
+++ b/pkg/workflow/compiler_safe_outputs_specialized.go
@@ -11,15 +11,21 @@ var specializedOutputsLog = logger.New("workflow:compiler_safe_outputs_specializ
 // buildAssignToAgentStepConfig builds the configuration for assigning to an agent
 func (c *Compiler) buildAssignToAgentStepConfig(data *WorkflowData, mainJobName string, threatDetectionEnabled bool) SafeOutputStepConfig {
 	cfg := data.SafeOutputs.AssignToAgent
-	specializedOutputsLog.Printf("Building assign-to-agent step config: max=%d, default_agent=%s", cfg.Max, cfg.DefaultAgent)
+	if cfg.Max != nil {
+		specializedOutputsLog.Printf("Building assign-to-agent step config: max=%s, default_agent=%s", *cfg.Max, cfg.DefaultAgent)
+	} else {
+		specializedOutputsLog.Printf("Building assign-to-agent step config: max=nil, default_agent=%s", cfg.DefaultAgent)
+	}
 
 	var customEnvVars []string
 	customEnvVars = append(customEnvVars, c.buildStepLevelSafeOutputEnvVars(data, cfg.TargetRepoSlug)...)
 	customEnvVars = append(customEnvVars, buildAllowedReposEnvVar("GH_AW_ALLOWED_REPOS", cfg.AllowedRepos)...)
 
 	// Add max count environment variable for JavaScript to validate against
-	if cfg.Max > 0 {
-		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_AGENT_MAX_COUNT: %d\n", cfg.Max))
+	if maxVal := templatableIntValue(cfg.Max); maxVal > 0 {
+		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_AGENT_MAX_COUNT: %d\n", maxVal))
+	} else if cfg.Max != nil {
+		customEnvVars = append(customEnvVars, buildTemplatableIntEnvVar("GH_AW_AGENT_MAX_COUNT", cfg.Max)...)
 	}
 
 	// Add default agent environment variable
diff --git a/pkg/workflow/compiler_safe_outputs_steps_test.go b/pkg/workflow/compiler_safe_outputs_steps_test.go
index 6ab031a528..e493faca2f 100644
--- a/pkg/workflow/compiler_safe_outputs_steps_test.go
+++ b/pkg/workflow/compiler_safe_outputs_steps_test.go
@@ -434,7 +434,7 @@ func TestBuildHandlerManagerStep(t *testing.T) {
 				},
 				AddComments: &AddCommentsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 				},
 				CreateDiscussions: &CreateDiscussionsConfig{
@@ -451,7 +451,7 @@ func TestBuildHandlerManagerStep(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				UpdateProjects: &UpdateProjectConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 					Project: "https://github.com/orgs/github-agentic-workflows/projects/1",
 				},
@@ -469,7 +469,7 @@ func TestBuildHandlerManagerStep(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				UpdateProjects: &UpdateProjectConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 5,
+						Max: strPtr("5"),
 					},
 					Project: "https://github.com/orgs/github-agentic-workflows/projects/1",
 				},
@@ -483,7 +483,7 @@ func TestBuildHandlerManagerStep(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				CreateProjectStatusUpdates: &CreateProjectStatusUpdateConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 1,
+						Max: strPtr("1"),
 					},
 					Project: "https://github.com/orgs/github-agentic-workflows/projects/1",
 				},
diff --git a/pkg/workflow/compiler_types.go b/pkg/workflow/compiler_types.go
index 039df5a1b5..71d3025327 100644
--- a/pkg/workflow/compiler_types.go
+++ b/pkg/workflow/compiler_types.go
@@ -466,9 +466,9 @@ type WorkflowData struct {
 
 // BaseSafeOutputConfig holds common configuration fields for all safe output types
 type BaseSafeOutputConfig struct {
-	Max         int    `yaml:"max,omitempty"`          // Maximum number of items to create
-	GitHubToken string `yaml:"github-token,omitempty"` // GitHub token for this specific output type
-	Staged      bool   `yaml:"staged,omitempty"`       // If true, emit step summary messages instead of making GitHub API calls for this specific output type
+	Max         *string `yaml:"max,omitempty"`          // Maximum number of items to create (supports integer or GitHub Actions expression)
+	GitHubToken string  `yaml:"github-token,omitempty"` // GitHub token for this specific output type
+	Staged      bool    `yaml:"staged,omitempty"`       // If true, emit step summary messages instead of making GitHub API calls for this specific output type
 }
 
 // SafeOutputsConfig holds configuration for automatic output routes
diff --git a/pkg/workflow/config_parsing_helpers_test.go b/pkg/workflow/config_parsing_helpers_test.go
index 9c3562e15c..cb918aed89 100644
--- a/pkg/workflow/config_parsing_helpers_test.go
+++ b/pkg/workflow/config_parsing_helpers_test.go
@@ -1117,7 +1117,7 @@ func TestUnmarshalConfig(t *testing.T) {
 				if config.Expires != 7 {
 					t.Errorf("expected expires 7, got %d", config.Expires)
 				}
-				if config.Max != 5 {
+				if templatableIntValue(config.Max) != 5 {
 					t.Errorf("expected max 5, got %d", config.Max)
 				}
 				if config.GitHubToken != "${{ secrets.TOKEN }}" {
@@ -1156,7 +1156,7 @@ func TestUnmarshalConfig(t *testing.T) {
 				if config.TitlePrefix != "[auto] " {
 					t.Errorf("expected title-prefix '[auto] ', got %q", config.TitlePrefix)
 				}
-				if config.Max != 3 {
+				if templatableIntValue(config.Max) != 3 {
 					t.Errorf("expected max 3, got %d", config.Max)
 				}
 				// Other fields should be zero values
@@ -1182,7 +1182,7 @@ func TestUnmarshalConfig(t *testing.T) {
 			expectError: false,
 			validate: func(t *testing.T, config *CreateIssuesConfig) {
 				// All fields should be zero values
-				if config.Max != 0 {
+				if templatableIntValue(config.Max) != 0 {
 					t.Errorf("expected max 0, got %d", config.Max)
 				}
 			},
diff --git a/pkg/workflow/create_agent_session.go b/pkg/workflow/create_agent_session.go
index 0060952d71..69f3c38151 100644
--- a/pkg/workflow/create_agent_session.go
+++ b/pkg/workflow/create_agent_session.go
@@ -43,7 +43,7 @@ func (c *Compiler) parseAgentSessionConfig(outputMap map[string]any) *CreateAgen
 		} else {
 			// If configData is nil or not a map (e.g., "create-agent-session:" with no value),
 			// still set the default max
-			agentSessionConfig.Max = 1
+			agentSessionConfig.Max = defaultIntStr(1)
 		}
 
 		return agentSessionConfig
@@ -74,7 +74,7 @@ func (c *Compiler) parseAgentSessionConfig(outputMap map[string]any) *CreateAgen
 		} else {
 			// If configData is nil or not a map (e.g., "create-agent-task:" with no value),
 			// still set the default max
-			agentSessionConfig.Max = 1
+			agentSessionConfig.Max = defaultIntStr(1)
 		}
 
 		return agentSessionConfig
diff --git a/pkg/workflow/create_agent_session_test.go b/pkg/workflow/create_agent_session_test.go
index 2f18341925..7fa4ce65ee 100644
--- a/pkg/workflow/create_agent_session_test.go
+++ b/pkg/workflow/create_agent_session_test.go
@@ -91,7 +91,7 @@ func TestParseAgentTaskConfig(t *testing.T) {
 				if config.TargetRepoSlug != tt.wantRepo {
 					t.Errorf("parseAgentSessionConfig().TargetRepoSlug = %v, want %v", config.TargetRepoSlug, tt.wantRepo)
 				}
-				if config.Max != 1 {
+				if templatableIntValue(config.Max) != 1 {
 					t.Errorf("parseAgentSessionConfig().Max = %v, want 1", config.Max)
 				}
 			}
@@ -106,7 +106,7 @@ func TestBuildCreateOutputAgentTaskJob(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			CreateAgentSessions: &CreateAgentSessionConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 				Base:           "main",
 				TargetRepoSlug: "owner/repo",
diff --git a/pkg/workflow/create_code_scanning_alert.go b/pkg/workflow/create_code_scanning_alert.go
index 5e6cdcfb22..bccb29a737 100644
--- a/pkg/workflow/create_code_scanning_alert.go
+++ b/pkg/workflow/create_code_scanning_alert.go
@@ -22,8 +22,10 @@ func (c *Compiler) buildCreateOutputCodeScanningAlertJob(data *WorkflowData, mai
 
 	// Build custom environment variables specific to create-code-scanning-alert
 	var customEnvVars []string
-	if data.SafeOutputs.CreateCodeScanningAlerts.Max > 0 {
-		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_SECURITY_REPORT_MAX: %d\n", data.SafeOutputs.CreateCodeScanningAlerts.Max))
+	if maxVal := templatableIntValue(data.SafeOutputs.CreateCodeScanningAlerts.Max); maxVal > 0 {
+		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_SECURITY_REPORT_MAX: %d\n", maxVal))
+	} else {
+		customEnvVars = append(customEnvVars, buildTemplatableIntEnvVar("GH_AW_SECURITY_REPORT_MAX", data.SafeOutputs.CreateCodeScanningAlerts.Max)...)
 	}
 	// Pass the driver configuration, defaulting to frontmatter name
 	driverName := data.SafeOutputs.CreateCodeScanningAlerts.Driver
@@ -107,8 +109,8 @@ func (c *Compiler) parseCodeScanningAlertsConfig(outputMap map[string]any) *Crea
 		c.parseBaseSafeOutputConfig(configMap, &securityReportsConfig.BaseSafeOutputConfig, 0)
 	} else {
 		// If configData is nil or not a map (e.g., "create-code-scanning-alert:" with no value),
-		// still set the default max (0 = unlimited)
-		securityReportsConfig.Max = 0
+		// still set the default max (nil = unlimited)
+		securityReportsConfig.Max = nil
 	}
 
 	return securityReportsConfig
diff --git a/pkg/workflow/create_discussion.go b/pkg/workflow/create_discussion.go
index 102a25e7a6..ea6f7eea0e 100644
--- a/pkg/workflow/create_discussion.go
+++ b/pkg/workflow/create_discussion.go
@@ -49,6 +49,12 @@ func (c *Compiler) parseDiscussionsConfig(outputMap map[string]any) *CreateDiscu
 		}
 	}
 
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", discussionLog); err != nil {
+		discussionLog.Printf("Invalid max value: %v", err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config CreateDiscussionsConfig
 	if err := unmarshalConfig(outputMap, "create-discussion", &config, discussionLog); err != nil {
@@ -58,8 +64,8 @@ func (c *Compiler) parseDiscussionsConfig(outputMap map[string]any) *CreateDiscu
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 	}
 
 	// Set default expires to 7 days (168 hours) if not specified and not explicitly disabled
diff --git a/pkg/workflow/create_discussion_dependencies_test.go b/pkg/workflow/create_discussion_dependencies_test.go
index 5d273183d4..5f412cc64b 100644
--- a/pkg/workflow/create_discussion_dependencies_test.go
+++ b/pkg/workflow/create_discussion_dependencies_test.go
@@ -39,7 +39,7 @@ func TestCreateDiscussionJobDependencies(t *testing.T) {
 				SafeOutputs: &SafeOutputsConfig{
 					CreateDiscussions: &CreateDiscussionsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 1,
+							Max: strPtr("1"),
 						},
 						Category: "general",
 					},
diff --git a/pkg/workflow/create_issue.go b/pkg/workflow/create_issue.go
index 940b60fcd3..047322cda6 100644
--- a/pkg/workflow/create_issue.go
+++ b/pkg/workflow/create_issue.go
@@ -47,6 +47,12 @@ func (c *Compiler) parseIssuesConfig(outputMap map[string]any) *CreateIssuesConf
 		}
 	}
 
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", createIssueLog); err != nil {
+		createIssueLog.Printf("Invalid max value: %v", err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config CreateIssuesConfig
 	if err := unmarshalConfig(outputMap, "create-issue", &config, createIssueLog); err != nil {
@@ -66,8 +72,8 @@ func (c *Compiler) parseIssuesConfig(outputMap map[string]any) *CreateIssuesConf
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 	}
 
 	// Validate target-repo (wildcard "*" is not allowed)
diff --git a/pkg/workflow/create_pr_review_comment.go b/pkg/workflow/create_pr_review_comment.go
index be6b31400c..bf54260d87 100644
--- a/pkg/workflow/create_pr_review_comment.go
+++ b/pkg/workflow/create_pr_review_comment.go
@@ -124,7 +124,7 @@ func (c *Compiler) parsePullRequestReviewCommentsConfig(outputMap map[string]any
 	} else {
 		// If configData is nil or not a map (e.g., "create-pull-request-review-comment:" with no value),
 		// still set the default max
-		prReviewCommentsConfig.Max = 10
+		prReviewCommentsConfig.Max = defaultIntStr(10)
 	}
 
 	return prReviewCommentsConfig
diff --git a/pkg/workflow/create_project.go b/pkg/workflow/create_project.go
index 38e8d32b60..60924cd724 100644
--- a/pkg/workflow/create_project.go
+++ b/pkg/workflow/create_project.go
@@ -19,7 +19,7 @@ func (c *Compiler) parseCreateProjectsConfig(outputMap map[string]any) *CreatePr
 	if configData, exists := outputMap["create-project"]; exists {
 		createProjectLog.Print("Parsing create-project configuration")
 		createProjectsConfig := &CreateProjectsConfig{}
-		createProjectsConfig.Max = 1 // Default max is 1
+		createProjectsConfig.Max = defaultIntStr(1) // Default max is 1
 
 		if configMap, ok := configData.(map[string]any); ok {
 			// Parse base config (max, github-token)
diff --git a/pkg/workflow/create_project_status_update.go b/pkg/workflow/create_project_status_update.go
index 3ca612e7f1..981fca18d1 100644
--- a/pkg/workflow/create_project_status_update.go
+++ b/pkg/workflow/create_project_status_update.go
@@ -18,7 +18,7 @@ func (c *Compiler) parseCreateProjectStatusUpdateConfig(outputMap map[string]any
 	if configData, exists := outputMap["create-project-status-update"]; exists {
 		createProjectStatusUpdateLog.Print("Parsing create-project-status-update configuration")
 		config := &CreateProjectStatusUpdateConfig{}
-		config.Max = 10 // Default max is 10
+		config.Max = defaultIntStr(10) // Default max is 10
 
 		if configMap, ok := configData.(map[string]any); ok {
 			c.parseBaseSafeOutputConfig(configMap, &config.BaseSafeOutputConfig, 10)
diff --git a/pkg/workflow/create_project_test.go b/pkg/workflow/create_project_test.go
index 5542c533e3..ee28a8ee2d 100644
--- a/pkg/workflow/create_project_test.go
+++ b/pkg/workflow/create_project_test.go
@@ -25,7 +25,7 @@ func TestParseCreateProjectsConfig(t *testing.T) {
 			},
 			expectedConfig: &CreateProjectsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 2,
+					Max: strPtr("2"),
 				},
 			},
 		},
@@ -41,7 +41,7 @@ func TestParseCreateProjectsConfig(t *testing.T) {
 			},
 			expectedConfig: &CreateProjectsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 				GitHubToken: "${{ secrets.PROJECTS_PAT }}",
 				TargetOwner: "myorg",
@@ -69,7 +69,7 @@ func TestParseCreateProjectsConfig(t *testing.T) {
 			},
 			expectedConfig: &CreateProjectsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 				Views: []ProjectView{
 					{
@@ -103,7 +103,7 @@ func TestParseCreateProjectsConfig(t *testing.T) {
 			},
 			expectedConfig: &CreateProjectsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 				Views: []ProjectView{
 					{
@@ -125,7 +125,7 @@ func TestParseCreateProjectsConfig(t *testing.T) {
 			},
 			expectedConfig: &CreateProjectsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 				TargetOwner: "testorg",
 			},
@@ -165,7 +165,7 @@ func TestParseCreateProjectsConfig(t *testing.T) {
 			},
 			expectedConfig: &CreateProjectsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 				Views: []ProjectView{
 					{
@@ -226,7 +226,7 @@ func TestCreateProjectsConfig_DefaultMax(t *testing.T) {
 	require.NotNil(t, config)
 
 	// Default max should be 1 when not specified
-	assert.Equal(t, 1, config.Max, "Default max should be 1")
+	assert.Equal(t, strPtr("1"), config.Max, "Default max should be 1")
 }
 
 func TestCreateProjectsConfig_ViewsParsing(t *testing.T) {
diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go
index f7878a7bb3..26aace57e9 100644
--- a/pkg/workflow/create_pull_request.go
+++ b/pkg/workflow/create_pull_request.go
@@ -274,6 +274,12 @@ func (c *Compiler) parsePullRequestsConfig(outputMap map[string]any) *CreatePull
 		}
 	}
 
+	// Pre-process templatable int fields
+	if err := preprocessIntFieldAsString(configData, "max", createPRLog); err != nil {
+		createPRLog.Printf("Invalid max value: %v", err)
+		return nil
+	}
+
 	// Unmarshal into typed config struct
 	var config CreatePullRequestsConfig
 	if err := unmarshalConfig(outputMap, "create-pull-request", &config, createPRLog); err != nil {
@@ -293,11 +299,11 @@ func (c *Compiler) parsePullRequestsConfig(outputMap map[string]any) *CreatePull
 	}
 
 	// Set default max if not explicitly configured (default is 1)
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 		createPRLog.Print("Using default max count: 1")
 	} else {
-		createPRLog.Printf("Pull request max count configured: %d", config.Max)
+		createPRLog.Printf("Pull request max count configured: %s", *config.Max)
 	}
 
 	return &config
diff --git a/pkg/workflow/dispatch_workflow.go b/pkg/workflow/dispatch_workflow.go
index 1359912ae6..c5d7114b21 100644
--- a/pkg/workflow/dispatch_workflow.go
+++ b/pkg/workflow/dispatch_workflow.go
@@ -28,7 +28,7 @@ func (c *Compiler) parseDispatchWorkflowConfig(outputMap map[string]any) *Dispat
 				}
 			}
 			// Set default max to 1
-			dispatchWorkflowConfig.Max = 1
+			dispatchWorkflowConfig.Max = defaultIntStr(1)
 			return dispatchWorkflowConfig
 		}
 
@@ -50,13 +50,13 @@ func (c *Compiler) parseDispatchWorkflowConfig(outputMap map[string]any) *Dispat
 			// Parse common base fields with default max of 1
 			c.parseBaseSafeOutputConfig(configMap, &dispatchWorkflowConfig.BaseSafeOutputConfig, 1)
 
-			// Cap max at 50 (absolute maximum allowed)
-			if dispatchWorkflowConfig.Max > 50 {
-				dispatchWorkflowLog.Printf("Max value %d exceeds limit, capping at 50", dispatchWorkflowConfig.Max)
-				dispatchWorkflowConfig.Max = 50
+			// Cap max at 50 (absolute maximum allowed) – only for literal integer values
+			if maxVal := templatableIntValue(dispatchWorkflowConfig.Max); maxVal > 50 {
+				dispatchWorkflowLog.Printf("Max value %d exceeds limit, capping at 50", maxVal)
+				dispatchWorkflowConfig.Max = defaultIntStr(50)
 			}
 
-			dispatchWorkflowLog.Printf("Parsed dispatch-workflow config: max=%d, workflows=%v",
+			dispatchWorkflowLog.Printf("Parsed dispatch-workflow config: max=%v, workflows=%v",
 				dispatchWorkflowConfig.Max, dispatchWorkflowConfig.Workflows)
 			return dispatchWorkflowConfig
 		}
diff --git a/pkg/workflow/dispatch_workflow_test.go b/pkg/workflow/dispatch_workflow_test.go
index 7558340b38..c7498485a7 100644
--- a/pkg/workflow/dispatch_workflow_test.go
+++ b/pkg/workflow/dispatch_workflow_test.go
@@ -86,7 +86,7 @@ This workflow dispatches to ci workflow.
 	require.NotNil(t, workflowData.SafeOutputs.DispatchWorkflow, "DispatchWorkflow should not be nil")
 
 	// Verify dispatch-workflow configuration
-	assert.Equal(t, 1, workflowData.SafeOutputs.DispatchWorkflow.Max)
+	assert.Equal(t, strPtr("1"), workflowData.SafeOutputs.DispatchWorkflow.Max)
 	assert.Equal(t, []string{"ci"}, workflowData.SafeOutputs.DispatchWorkflow.Workflows)
 
 	// Validate the workflow - should find ci in .github/workflows
diff --git a/pkg/workflow/dispatch_workflow_validation_test.go b/pkg/workflow/dispatch_workflow_validation_test.go
index 24bfcccac4..b385fcad57 100644
--- a/pkg/workflow/dispatch_workflow_validation_test.go
+++ b/pkg/workflow/dispatch_workflow_validation_test.go
@@ -32,7 +32,7 @@ func TestDispatchWorkflowErrorMessage_EmptyList(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			DispatchWorkflow: &DispatchWorkflowConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 				Workflows: []string{}, // Empty list
 			},
diff --git a/pkg/workflow/hide_comment.go b/pkg/workflow/hide_comment.go
index c487a9d70a..2d3d2f1408 100644
--- a/pkg/workflow/hide_comment.go
+++ b/pkg/workflow/hide_comment.go
@@ -48,7 +48,7 @@ func (c *Compiler) parseHideCommentConfig(outputMap map[string]any) *HideComment
 				hideCommentConfig.Max, hideCommentConfig.TargetRepoSlug)
 		} else {
 			// If configData is nil or not a map, still set the default max
-			hideCommentConfig.Max = 5
+			hideCommentConfig.Max = defaultIntStr(5)
 		}
 
 		return hideCommentConfig
diff --git a/pkg/workflow/link_sub_issue.go b/pkg/workflow/link_sub_issue.go
index 86a3010c6c..4965b0e2be 100644
--- a/pkg/workflow/link_sub_issue.go
+++ b/pkg/workflow/link_sub_issue.go
@@ -52,7 +52,7 @@ func (c *Compiler) parseLinkSubIssueConfig(outputMap map[string]any) *LinkSubIss
 				len(linkSubIssueConfig.SubRequiredLabels), linkSubIssueConfig.TargetRepoSlug)
 		} else {
 			// If configData is nil or not a map, still set the default max
-			linkSubIssueConfig.Max = 5
+			linkSubIssueConfig.Max = defaultIntStr(5)
 		}
 
 		return linkSubIssueConfig
diff --git a/pkg/workflow/missing_data.go b/pkg/workflow/missing_data.go
index 1746ad1cd1..d4793e6875 100644
--- a/pkg/workflow/missing_data.go
+++ b/pkg/workflow/missing_data.go
@@ -27,9 +27,9 @@ func (c *Compiler) buildCreateOutputMissingDataJob(data *WorkflowData, mainJobNa
 
 	// Build custom environment variables specific to missing-data
 	var customEnvVars []string
-	if data.SafeOutputs.MissingData.Max > 0 {
-		missingDataLog.Printf("Setting max missing data limit: %d", data.SafeOutputs.MissingData.Max)
-		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_MISSING_DATA_MAX: %d\n", data.SafeOutputs.MissingData.Max))
+	if data.SafeOutputs.MissingData.Max != nil {
+		missingDataLog.Printf("Setting max missing data limit: %s", *data.SafeOutputs.MissingData.Max)
+		customEnvVars = append(customEnvVars, buildTemplatableIntEnvVar("GH_AW_MISSING_DATA_MAX", data.SafeOutputs.MissingData.Max)...)
 	}
 
 	// Add create-issue configuration
diff --git a/pkg/workflow/missing_data_test.go b/pkg/workflow/missing_data_test.go
index 2b88855e50..8f3c3c8f97 100644
--- a/pkg/workflow/missing_data_test.go
+++ b/pkg/workflow/missing_data_test.go
@@ -102,8 +102,8 @@ func TestMissingDataSafeOutput(t *testing.T) {
 				if safeOutputs.MissingData == nil {
 					t.Error("Expected MissingData config to be present, but it was nil")
 				} else {
-					if safeOutputs.MissingData.Max != tt.expectMax {
-						t.Errorf("Expected Max=%d, got Max=%d", tt.expectMax, safeOutputs.MissingData.Max)
+					if templatableIntValue(safeOutputs.MissingData.Max) != tt.expectMax {
+						t.Errorf("Expected Max=%d, got Max=%v", tt.expectMax, safeOutputs.MissingData.Max)
 					}
 				}
 			} else {
@@ -193,8 +193,8 @@ func TestMissingDataConfigParsing(t *testing.T) {
 				t.Fatal("Expected non-nil config, but got nil")
 			}
 
-			if config.Max != tt.expectMax {
-				t.Errorf("Expected Max=%d, got Max=%d", tt.expectMax, config.Max)
+			if templatableIntValue(config.Max) != tt.expectMax {
+				t.Errorf("Expected Max=%d, got Max=%v", tt.expectMax, config.Max)
 			}
 
 			if config.CreateIssue != tt.expectIssue {
@@ -221,7 +221,7 @@ func TestBuildCreateOutputMissingDataJob(t *testing.T) {
 		{
 			name: "Basic config without issue creation",
 			config: &MissingDataConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 0},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("0")},
 				CreateIssue:          false,
 				TitlePrefix:          "[missing data]",
 				Labels:               []string{},
@@ -231,7 +231,7 @@ func TestBuildCreateOutputMissingDataJob(t *testing.T) {
 		{
 			name: "Config with issue creation",
 			config: &MissingDataConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				CreateIssue:          true,
 				TitlePrefix:          "[data needed]",
 				Labels:               []string{"data", "blocked"},
diff --git a/pkg/workflow/missing_tool.go b/pkg/workflow/missing_tool.go
index feeffeaa04..c387a53bca 100644
--- a/pkg/workflow/missing_tool.go
+++ b/pkg/workflow/missing_tool.go
@@ -27,9 +27,9 @@ func (c *Compiler) buildCreateOutputMissingToolJob(data *WorkflowData, mainJobNa
 
 	// Build custom environment variables specific to missing-tool
 	var customEnvVars []string
-	if data.SafeOutputs.MissingTool.Max > 0 {
-		missingToolLog.Printf("Setting max missing tools limit: %d", data.SafeOutputs.MissingTool.Max)
-		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_MISSING_TOOL_MAX: %d\n", data.SafeOutputs.MissingTool.Max))
+	if data.SafeOutputs.MissingTool.Max != nil {
+		missingToolLog.Printf("Setting max missing tools limit: %s", *data.SafeOutputs.MissingTool.Max)
+		customEnvVars = append(customEnvVars, buildTemplatableIntEnvVar("GH_AW_MISSING_TOOL_MAX", data.SafeOutputs.MissingTool.Max)...)
 	}
 
 	// Add create-issue configuration
diff --git a/pkg/workflow/missing_tool_test.go b/pkg/workflow/missing_tool_test.go
index 4acff076c3..4085bba7be 100644
--- a/pkg/workflow/missing_tool_test.go
+++ b/pkg/workflow/missing_tool_test.go
@@ -103,8 +103,8 @@ func TestMissingToolSafeOutput(t *testing.T) {
 				if safeOutputs.MissingTool == nil {
 					t.Fatal("Expected MissingTool config to be enabled, but it was nil")
 				}
-				if safeOutputs.MissingTool.Max != tt.expectMax {
-					t.Errorf("Expected max to be %d, got %d", tt.expectMax, safeOutputs.MissingTool.Max)
+				if templatableIntValue(safeOutputs.MissingTool.Max) != tt.expectMax {
+					t.Errorf("Expected max to be %d, got %v", tt.expectMax, safeOutputs.MissingTool.Max)
 				}
 			} else {
 				if safeOutputs != nil && safeOutputs.MissingTool != nil {
@@ -170,7 +170,7 @@ func TestMissingToolPromptGeneration(t *testing.T) {
 	data := &WorkflowData{
 		MarkdownContent: "Test workflow content",
 		SafeOutputs: &SafeOutputsConfig{
-			MissingTool: &MissingToolConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10}},
+			MissingTool: &MissingToolConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")}},
 		},
 	}
 
@@ -336,8 +336,8 @@ func TestMissingToolConfigParsing(t *testing.T) {
 				if config == nil {
 					t.Fatal("Expected non-nil config")
 				}
-				if config.Max != tt.expectMax {
-					t.Errorf("Expected max %d, got %d", tt.expectMax, config.Max)
+				if templatableIntValue(config.Max) != tt.expectMax {
+					t.Errorf("Expected max %d, got %v", tt.expectMax, config.Max)
 				}
 				if config.CreateIssue != tt.expectCreateIssue {
 					t.Errorf("Expected create-issue %v, got %v", tt.expectCreateIssue, config.CreateIssue)
diff --git a/pkg/workflow/neutral_tools_simple_test.go b/pkg/workflow/neutral_tools_simple_test.go
index 419dbad7aa..fac889292b 100644
--- a/pkg/workflow/neutral_tools_simple_test.go
+++ b/pkg/workflow/neutral_tools_simple_test.go
@@ -24,7 +24,7 @@ func TestNeutralToolsExpandsToClaudeTools(t *testing.T) {
 	// Test with safe outputs that require git commands
 	safeOutputs := &SafeOutputsConfig{
 		CreatePullRequests: &CreatePullRequestsConfig{
-			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 		},
 	}
 
diff --git a/pkg/workflow/noop.go b/pkg/workflow/noop.go
index c7af28aab6..b1f1e97917 100644
--- a/pkg/workflow/noop.go
+++ b/pkg/workflow/noop.go
@@ -28,7 +28,7 @@ func (c *Compiler) parseNoOpConfig(outputMap map[string]any) *NoOpConfig {
 		// Handle the case where configData is nil (noop: with no value)
 		if configData == nil {
 			// Set default max for noop messages
-			noopConfig.Max = 1
+			noopConfig.Max = defaultIntStr(1)
 			// Set default report-as-issue to true
 			trueVal := "true"
 			noopConfig.ReportAsIssue = &trueVal
@@ -57,7 +57,9 @@ func (c *Compiler) parseNoOpConfig(outputMap map[string]any) *NoOpConfig {
 				noopLog.Print("report-as-issue not specified, defaulting to true")
 			}
 
-			noopLog.Printf("Parsed noop configuration: max=%d, report-as-issue=%s", noopConfig.Max, *noopConfig.ReportAsIssue)
+			if noopConfig.Max != nil {
+				noopLog.Printf("Parsed noop configuration: max=%s, report-as-issue=%s", *noopConfig.Max, *noopConfig.ReportAsIssue)
+			}
 		}
 
 		return noopConfig
diff --git a/pkg/workflow/noop_test.go b/pkg/workflow/noop_test.go
index 4cdc8fae1b..45bc7272f9 100644
--- a/pkg/workflow/noop_test.go
+++ b/pkg/workflow/noop_test.go
@@ -13,14 +13,14 @@ func TestParseNoOpConfig(t *testing.T) {
 		name           string
 		outputMap      map[string]any
 		expectedNil    bool
-		expectedMax    int
+		expectedMax    *string
 		expectedReport *string
 	}{
 		{
 			name:           "noop not present",
 			outputMap:      map[string]any{},
 			expectedNil:    true,
-			expectedMax:    0,
+			expectedMax:    nil,
 			expectedReport: nil,
 		},
 		{
@@ -29,7 +29,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				"noop": false,
 			},
 			expectedNil:    true,
-			expectedMax:    0,
+			expectedMax:    nil,
 			expectedReport: nil,
 		},
 		{
@@ -38,7 +38,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				"noop": nil,
 			},
 			expectedNil:    false,
-			expectedMax:    1,
+			expectedMax:    strPtr("1"),
 			expectedReport: testStringPtr("true"),
 		},
 		{
@@ -47,7 +47,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				"noop": map[string]any{},
 			},
 			expectedNil:    false,
-			expectedMax:    1,
+			expectedMax:    strPtr("1"),
 			expectedReport: testStringPtr("true"),
 		},
 		{
@@ -58,7 +58,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				},
 			},
 			expectedNil:    false,
-			expectedMax:    5,
+			expectedMax:    strPtr("5"),
 			expectedReport: testStringPtr("true"),
 		},
 		{
@@ -69,7 +69,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				},
 			},
 			expectedNil:    false,
-			expectedMax:    1,
+			expectedMax:    strPtr("1"),
 			expectedReport: testStringPtr("true"),
 		},
 		{
@@ -80,7 +80,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				},
 			},
 			expectedNil:    false,
-			expectedMax:    1,
+			expectedMax:    strPtr("1"),
 			expectedReport: testStringPtr("false"),
 		},
 		{
@@ -92,7 +92,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				},
 			},
 			expectedNil:    false,
-			expectedMax:    3,
+			expectedMax:    strPtr("3"),
 			expectedReport: testStringPtr("false"),
 		},
 		{
@@ -103,7 +103,7 @@ func TestParseNoOpConfig(t *testing.T) {
 				},
 			},
 			expectedNil:    false,
-			expectedMax:    2,
+			expectedMax:    strPtr("2"),
 			expectedReport: testStringPtr("true"),
 		},
 	}
diff --git a/pkg/workflow/notify_comment.go b/pkg/workflow/notify_comment.go
index 647baceab2..b183967e71 100644
--- a/pkg/workflow/notify_comment.go
+++ b/pkg/workflow/notify_comment.go
@@ -58,9 +58,7 @@ func (c *Compiler) buildConclusionJob(data *WorkflowData, mainJobName string, sa
 	if data.SafeOutputs.NoOp != nil {
 		// Build custom environment variables specific to noop
 		var noopEnvVars []string
-		if data.SafeOutputs.NoOp.Max > 0 {
-			noopEnvVars = append(noopEnvVars, fmt.Sprintf("          GH_AW_NOOP_MAX: %d\n", data.SafeOutputs.NoOp.Max))
-		}
+		noopEnvVars = append(noopEnvVars, buildTemplatableIntEnvVar("GH_AW_NOOP_MAX", data.SafeOutputs.NoOp.Max)...)
 
 		// Add workflow metadata for consistency
 		noopEnvVars = append(noopEnvVars, buildWorkflowMetadataEnvVarsWithTrackerID(data.Name, data.Source, data.TrackerID)...)
@@ -82,9 +80,7 @@ func (c *Compiler) buildConclusionJob(data *WorkflowData, mainJobName string, sa
 	if data.SafeOutputs.MissingTool != nil {
 		// Build custom environment variables specific to missing-tool
 		var missingToolEnvVars []string
-		if data.SafeOutputs.MissingTool.Max > 0 {
-			missingToolEnvVars = append(missingToolEnvVars, fmt.Sprintf("          GH_AW_MISSING_TOOL_MAX: %d\n", data.SafeOutputs.MissingTool.Max))
-		}
+		missingToolEnvVars = append(missingToolEnvVars, buildTemplatableIntEnvVar("GH_AW_MISSING_TOOL_MAX", data.SafeOutputs.MissingTool.Max)...)
 
 		// Add create-issue configuration
 		if data.SafeOutputs.MissingTool.CreateIssue {
diff --git a/pkg/workflow/notify_comment_test.go b/pkg/workflow/notify_comment_test.go
index 9f84759778..1447e1d9ff 100644
--- a/pkg/workflow/notify_comment_test.go
+++ b/pkg/workflow/notify_comment_test.go
@@ -163,7 +163,7 @@ func TestConclusionJob(t *testing.T) {
 				workflowData.SafeOutputs = &SafeOutputsConfig{
 					AddComments: &AddCommentsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 1,
+							Max: strPtr("1"),
 						},
 					},
 				}
@@ -270,7 +270,7 @@ func TestConclusionJobIntegration(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 			},
 		},
@@ -340,7 +340,7 @@ func TestConclusionJobWithMessages(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 			},
 			Messages: &SafeOutputMessagesConfig{
@@ -392,7 +392,7 @@ func TestConclusionJobWithoutMessages(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 			},
 			// Messages intentionally nil
@@ -435,7 +435,7 @@ func TestActivationJobWithMessages(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 			},
 			Messages: &SafeOutputMessagesConfig{
@@ -484,7 +484,7 @@ func TestActivationJobWithoutMessages(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 			},
 			// Messages intentionally nil
@@ -526,7 +526,7 @@ func TestConclusionJobWithGeneratedAssets(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			AddComments: &AddCommentsConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 			},
 			NoOp: &NoOpConfig{},
diff --git a/pkg/workflow/publish_assets_test.go b/pkg/workflow/publish_assets_test.go
index 1ee61968db..99b74036d9 100644
--- a/pkg/workflow/publish_assets_test.go
+++ b/pkg/workflow/publish_assets_test.go
@@ -43,7 +43,7 @@ func TestParseUploadAssetConfig(t *testing.T) {
 				BranchName:           "assets/${{ github.workflow }}",
 				MaxSizeKB:            10240,
 				AllowedExts:          []string{".png", ".jpg", ".jpeg"},
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 			},
 		},
 		{
@@ -81,8 +81,8 @@ func TestParseUploadAssetConfig(t *testing.T) {
 				t.Errorf("GitHubToken: expected %s, got %s", tt.expected.GitHubToken, result.GitHubToken)
 			}
 
-			if result.Max != tt.expected.Max {
-				t.Errorf("Max: expected %d, got %d", tt.expected.Max, result.Max)
+			if (result.Max == nil) != (tt.expected.Max == nil) || (result.Max != nil && *result.Max != *tt.expected.Max) {
+				t.Errorf("Max: expected %v, got %v", tt.expected.Max, result.Max)
 			}
 
 			if len(result.AllowedExts) != len(tt.expected.AllowedExts) {
diff --git a/pkg/workflow/reply_to_pr_review_comment.go b/pkg/workflow/reply_to_pr_review_comment.go
index 9c9a923acf..036e9197ad 100644
--- a/pkg/workflow/reply_to_pr_review_comment.go
+++ b/pkg/workflow/reply_to_pr_review_comment.go
@@ -63,7 +63,7 @@ func (c *Compiler) parseReplyToPullRequestReviewCommentConfig(outputMap map[stri
 			replyToPRReviewCommentLog.Printf("Parsed reply-to-pull-request-review-comment config: max=%d", config.Max)
 		} else {
 			// If configData is nil or not a map, still set the default max
-			config.Max = 10
+			config.Max = defaultIntStr(10)
 		}
 
 		return config
diff --git a/pkg/workflow/resolve_pr_review_thread.go b/pkg/workflow/resolve_pr_review_thread.go
index 5c101880f9..7b5a6dd8ca 100644
--- a/pkg/workflow/resolve_pr_review_thread.go
+++ b/pkg/workflow/resolve_pr_review_thread.go
@@ -28,7 +28,7 @@ func (c *Compiler) parseResolvePullRequestReviewThreadConfig(outputMap map[strin
 			resolvePRReviewThreadLog.Printf("Parsed resolve-pull-request-review-thread config: max=%d", config.Max)
 		} else {
 			// If configData is nil or not a map, still set the default max
-			config.Max = 10
+			config.Max = defaultIntStr(10)
 		}
 
 		return config
diff --git a/pkg/workflow/safe_output_builder.go b/pkg/workflow/safe_output_builder.go
index 423dab66c3..4a09fc86b9 100644
--- a/pkg/workflow/safe_output_builder.go
+++ b/pkg/workflow/safe_output_builder.go
@@ -151,6 +151,19 @@ func BuildMaxCountEnvVar(envVarName string, maxCount int) []string {
 	return []string{fmt.Sprintf("          %s: %d\n", envVarName, maxCount)}
 }
 
+// overrideEnvVarLine replaces the first env var line in lines that starts with keyPrefix
+// with newLine. If no match is found, newLine is appended.
+func overrideEnvVarLine(lines []string, keyPrefix string, newLine string) []string {
+	for i, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, keyPrefix) {
+			lines[i] = newLine
+			return lines
+		}
+	}
+	return append(lines, newLine)
+}
+
 // BuildAllowedListEnvVar builds an allowed list environment variable line for safe-output jobs.
 // envVarName should be the full env var name like "GH_AW_LABELS_ALLOWED".
 // Always outputs the env var, even when empty (empty string means "allow all").
@@ -304,16 +317,25 @@ type ListJobBuilderConfig struct {
 func (c *Compiler) BuildListSafeOutputJob(data *WorkflowData, mainJobName string, listJobConfig ListJobConfig, baseSafeOutputConfig BaseSafeOutputConfig, builderConfig ListJobBuilderConfig) (*Job, error) {
 	safeOutputBuilderLog.Printf("Building list safe-output job: %s", builderConfig.JobName)
 
-	// Handle max count with default
+	// Handle max count with default – use literal integer if set, else fall back to DefaultMax
 	maxCount := builderConfig.DefaultMax
-	if baseSafeOutputConfig.Max > 0 {
-		maxCount = baseSafeOutputConfig.Max
+	if n := templatableIntValue(baseSafeOutputConfig.Max); n > 0 {
+		maxCount = n
 	}
 	safeOutputBuilderLog.Printf("Max count set to: %d", maxCount)
 
 	// Build custom environment variables using shared helpers
 	customEnvVars := BuildListJobEnvVars(builderConfig.EnvPrefix, listJobConfig, maxCount)
 
+	// If max is a GitHub Actions expression, override with the expression value
+	if baseSafeOutputConfig.Max != nil && templatableIntValue(baseSafeOutputConfig.Max) == 0 {
+		exprLine := buildTemplatableIntEnvVar(builderConfig.EnvPrefix+"_MAX_COUNT", baseSafeOutputConfig.Max)
+		if len(exprLine) > 0 {
+			prefix := builderConfig.EnvPrefix + "_MAX_COUNT:"
+			customEnvVars = overrideEnvVarLine(customEnvVars, prefix, exprLine[0])
+		}
+	}
+
 	// Add standard environment variables (metadata + staged/target repo)
 	customEnvVars = append(customEnvVars, c.buildStandardSafeOutputEnvVars(data, listJobConfig.TargetRepoSlug)...)
 
diff --git a/pkg/workflow/safe_output_config.go b/pkg/workflow/safe_output_config.go
index 00f8d6a3f9..86d56f31af 100644
--- a/pkg/workflow/safe_output_config.go
+++ b/pkg/workflow/safe_output_config.go
@@ -1,18 +1,31 @@
 package workflow
 
+import "strings"
+
 // parseBaseSafeOutputConfig parses common fields (max, github-token) from a config map.
-// If defaultMax is provided (>= 0), it will be set as the default value for config.Max
-// before parsing the max field from configMap.
+// If defaultMax is provided (> 0), it will be set as the default value for config.Max
+// before parsing the max field from configMap. Supports both integer values and GitHub
+// Actions expression strings (e.g. "${{ inputs.max }}").
 func (c *Compiler) parseBaseSafeOutputConfig(configMap map[string]any, config *BaseSafeOutputConfig, defaultMax int) {
 	// Set default max if provided
-	if defaultMax >= 0 {
-		config.Max = defaultMax
+	if defaultMax > 0 {
+		config.Max = defaultIntStr(defaultMax)
 	}
 
 	// Parse max (this will override the default if present in configMap)
 	if max, exists := configMap["max"]; exists {
-		if maxInt, ok := parseIntValue(max); ok {
-			config.Max = maxInt
+		switch v := max.(type) {
+		case string:
+			// Accept GitHub Actions expression strings
+			if strings.HasPrefix(v, "${{") && strings.HasSuffix(v, "}}") {
+				config.Max = &v
+			}
+		default:
+			// Convert integer/float64/etc to string via parseIntValue
+			if maxInt, ok := parseIntValue(max); ok {
+				s := defaultIntStr(maxInt)
+				config.Max = s
+			}
 		}
 	}
 
diff --git a/pkg/workflow/safe_output_refactor_test.go b/pkg/workflow/safe_output_refactor_test.go
index c95b7144dd..1f1d721157 100644
--- a/pkg/workflow/safe_output_refactor_test.go
+++ b/pkg/workflow/safe_output_refactor_test.go
@@ -21,7 +21,7 @@ func TestCreatePRReviewCommentUsesHelper(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			Staged: true,
 			CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 				TargetRepoSlug:       "owner/target-repo",
 			},
 		},
@@ -56,7 +56,7 @@ func TestCreateDiscussionUsesHelper(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			Staged: true,
 			CreateDiscussions: &CreateDiscussionsConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Category:             "12345",
 				TargetRepoSlug:       "owner/target-repo",
 			},
@@ -94,7 +94,7 @@ func TestTrialModeWithoutTargetRepo(t *testing.T) {
 		TrialLogicalRepo: "owner/trial-repo",
 		SafeOutputs: &SafeOutputsConfig{
 			CreateDiscussions: &CreateDiscussionsConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Category:             "12345",
 			},
 		},
@@ -128,7 +128,7 @@ func TestNoStagedNorTrialMode(t *testing.T) {
 		Name: "test-workflow",
 		SafeOutputs: &SafeOutputsConfig{
 			CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 			},
 		},
 	}
@@ -163,7 +163,7 @@ func TestTargetRepoOverridesTrialRepo(t *testing.T) {
 		Name: "test-workflow",
 		SafeOutputs: &SafeOutputsConfig{
 			CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 				TargetRepoSlug:       "owner/explicit-target",
 			},
 		},
diff --git a/pkg/workflow/safe_outputs_config.go b/pkg/workflow/safe_outputs_config.go
index f5740eea62..798e978c99 100644
--- a/pkg/workflow/safe_outputs_config.go
+++ b/pkg/workflow/safe_outputs_config.go
@@ -332,7 +332,7 @@ func (c *Compiler) extractSafeOutputsConfig(frontmatter map[string]any) *SafeOut
 				// This ensures there's always a fallback for transparency
 				if _, exists := outputMap["noop"]; !exists {
 					config.NoOp = &NoOpConfig{}
-					config.NoOp.Max = 1 // Default max
+					config.NoOp.Max = defaultIntStr(1) // Default max
 					trueVal := "true"
 					config.NoOp.ReportAsIssue = &trueVal // Default to reporting to issue
 				}
diff --git a/pkg/workflow/safe_outputs_config_generation.go b/pkg/workflow/safe_outputs_config_generation.go
index 94075dd4e1..3b56285c15 100644
--- a/pkg/workflow/safe_outputs_config_generation.go
+++ b/pkg/workflow/safe_outputs_config_generation.go
@@ -276,8 +276,8 @@ func generateSafeOutputsConfig(data *WorkflowData) string {
 			missingToolConfig := make(map[string]any)
 
 			// Add max if set
-			if data.SafeOutputs.MissingTool.Max > 0 {
-				missingToolConfig["max"] = data.SafeOutputs.MissingTool.Max
+			if data.SafeOutputs.MissingTool.Max != nil {
+				missingToolConfig["max"] = resolveMaxForConfig(data.SafeOutputs.MissingTool.Max, 0)
 			}
 
 			// Add issue creation config if enabled
@@ -303,8 +303,8 @@ func generateSafeOutputsConfig(data *WorkflowData) string {
 			missingDataConfig := make(map[string]any)
 
 			// Add max if set
-			if data.SafeOutputs.MissingData.Max > 0 {
-				missingDataConfig["max"] = data.SafeOutputs.MissingData.Max
+			if data.SafeOutputs.MissingData.Max != nil {
+				missingDataConfig["max"] = resolveMaxForConfig(data.SafeOutputs.MissingData.Max, 0)
 			}
 
 			// Add issue creation config if enabled
@@ -470,11 +470,7 @@ func generateSafeOutputsConfig(data *WorkflowData) string {
 		}
 
 		// Include max count
-		maxValue := 1 // default
-		if data.SafeOutputs.DispatchWorkflow.Max > 0 {
-			maxValue = data.SafeOutputs.DispatchWorkflow.Max
-		}
-		dispatchWorkflowConfig["max"] = maxValue
+		dispatchWorkflowConfig["max"] = resolveMaxForConfig(data.SafeOutputs.DispatchWorkflow.Max, 1)
 
 		// Only add if it has fields
 		if len(dispatchWorkflowConfig) > 0 {
diff --git a/pkg/workflow/safe_outputs_config_generation_helpers.go b/pkg/workflow/safe_outputs_config_generation_helpers.go
index de1400563c..673335ef05 100644
--- a/pkg/workflow/safe_outputs_config_generation_helpers.go
+++ b/pkg/workflow/safe_outputs_config_generation_helpers.go
@@ -1,6 +1,10 @@
 package workflow
 
-import "github.com/github/gh-aw/pkg/logger"
+import (
+	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
+)
 
 var safeOutputsConfigGenLog = logger.New("workflow:safe_outputs_config_generation_helpers")
 
@@ -17,19 +21,33 @@ var safeOutputsConfigGenLog = logger.New("workflow:safe_outputs_config_generatio
 // The goal is to make generateSafeOutputsConfig more maintainable by
 // extracting repetitive code patterns into reusable functions.
 
+// resolveMaxForConfig resolves a templatable max *string to a config value.
+// For expression strings (e.g. "${{ inputs.max }}"), the expression is stored
+// as-is so GitHub Actions can resolve it at runtime.
+// For literal numeric strings, the parsed integer is used.
+// Falls back to defaultMax if max is nil or zero.
+func resolveMaxForConfig(max *string, defaultMax int) any {
+	if max != nil {
+		v := *max
+		if strings.HasPrefix(v, "${{") {
+			return v // expression: evaluated at runtime by GitHub Actions
+		}
+		if n := templatableIntValue(max); n > 0 {
+			return n
+		}
+	}
+	return defaultMax
+}
+
 // generateMaxConfig creates a simple config map with just a max value
-func generateMaxConfig(max int, defaultMax int) map[string]any {
+func generateMaxConfig(max *string, defaultMax int) map[string]any {
 	config := make(map[string]any)
-	maxValue := defaultMax
-	if max > 0 {
-		maxValue = max
-	}
-	config["max"] = maxValue
+	config["max"] = resolveMaxForConfig(max, defaultMax)
 	return config
 }
 
 // generateMaxWithAllowedLabelsConfig creates a config with max and optional allowed_labels
-func generateMaxWithAllowedLabelsConfig(max int, defaultMax int, allowedLabels []string) map[string]any {
+func generateMaxWithAllowedLabelsConfig(max *string, defaultMax int, allowedLabels []string) map[string]any {
 	config := generateMaxConfig(max, defaultMax)
 	if len(allowedLabels) > 0 {
 		config["allowed_labels"] = allowedLabels
@@ -38,21 +56,17 @@ func generateMaxWithAllowedLabelsConfig(max int, defaultMax int, allowedLabels [
 }
 
 // generateMaxWithTargetConfig creates a config with max and optional target field
-func generateMaxWithTargetConfig(max int, defaultMax int, target string) map[string]any {
+func generateMaxWithTargetConfig(max *string, defaultMax int, target string) map[string]any {
 	config := make(map[string]any)
 	if target != "" {
 		config["target"] = target
 	}
-	maxValue := defaultMax
-	if max > 0 {
-		maxValue = max
-	}
-	config["max"] = maxValue
+	config["max"] = resolveMaxForConfig(max, defaultMax)
 	return config
 }
 
 // generateMaxWithAllowedConfig creates a config with max and optional allowed list
-func generateMaxWithAllowedConfig(max int, defaultMax int, allowed []string) map[string]any {
+func generateMaxWithAllowedConfig(max *string, defaultMax int, allowed []string) map[string]any {
 	config := generateMaxConfig(max, defaultMax)
 	if len(allowed) > 0 {
 		config["allowed"] = allowed
@@ -61,7 +75,7 @@ func generateMaxWithAllowedConfig(max int, defaultMax int, allowed []string) map
 }
 
 // generateMaxWithAllowedAndBlockedConfig creates a config with max, optional allowed list, and optional blocked list
-func generateMaxWithAllowedAndBlockedConfig(max int, defaultMax int, allowed []string, blocked []string) map[string]any {
+func generateMaxWithAllowedAndBlockedConfig(max *string, defaultMax int, allowed []string, blocked []string) map[string]any {
 	config := generateMaxConfig(max, defaultMax)
 	if len(allowed) > 0 {
 		config["allowed"] = allowed
@@ -73,7 +87,7 @@ func generateMaxWithAllowedAndBlockedConfig(max int, defaultMax int, allowed []s
 }
 
 // generateMaxWithDiscussionFieldsConfig creates a config with discussion-specific filter fields
-func generateMaxWithDiscussionFieldsConfig(max int, defaultMax int, requiredCategory string, requiredLabels []string, requiredTitlePrefix string) map[string]any {
+func generateMaxWithDiscussionFieldsConfig(max *string, defaultMax int, requiredCategory string, requiredLabels []string, requiredTitlePrefix string) map[string]any {
 	config := generateMaxConfig(max, defaultMax)
 	if requiredCategory != "" {
 		config["required_category"] = requiredCategory
@@ -88,7 +102,7 @@ func generateMaxWithDiscussionFieldsConfig(max int, defaultMax int, requiredCate
 }
 
 // generateMaxWithReviewersConfig creates a config with max and optional reviewers list
-func generateMaxWithReviewersConfig(max int, defaultMax int, reviewers []string) map[string]any {
+func generateMaxWithReviewersConfig(max *string, defaultMax int, reviewers []string) map[string]any {
 	config := generateMaxConfig(max, defaultMax)
 	if len(reviewers) > 0 {
 		config["reviewers"] = reviewers
@@ -97,20 +111,13 @@ func generateMaxWithReviewersConfig(max int, defaultMax int, reviewers []string)
 }
 
 // generateAssignToAgentConfig creates a config with optional max, default_agent, target, and allowed
-func generateAssignToAgentConfig(max int, defaultMax int, defaultAgent string, target string, allowed []string) map[string]any {
+func generateAssignToAgentConfig(max *string, defaultMax int, defaultAgent string, target string, allowed []string) map[string]any {
 	if safeOutputsConfigGenLog.Enabled() {
-		safeOutputsConfigGenLog.Printf("Generating assign-to-agent config: max=%d, defaultMax=%d, defaultAgent=%s, target=%s, allowed_count=%d",
+		safeOutputsConfigGenLog.Printf("Generating assign-to-agent config: max=%v, defaultMax=%d, defaultAgent=%s, target=%s, allowed_count=%d",
 			max, defaultMax, defaultAgent, target, len(allowed))
 	}
 	config := make(map[string]any)
-
-	// Apply default max if max is not specified
-	maxValue := defaultMax
-	if max > 0 {
-		maxValue = max
-	}
-	config["max"] = maxValue
-
+	config["max"] = resolveMaxForConfig(max, defaultMax)
 	if defaultAgent != "" {
 		config["default_agent"] = defaultAgent
 	}
@@ -124,8 +131,8 @@ func generateAssignToAgentConfig(max int, defaultMax int, defaultAgent string, t
 }
 
 // generatePullRequestConfig creates a config with max, allowed_labels, allow_empty, auto_merge, and expires
-func generatePullRequestConfig(max int, defaultMax int, allowedLabels []string, allowEmpty *string, autoMerge *string, expires int) map[string]any {
-	safeOutputsConfigGenLog.Printf("Generating pull request config: max=%d, allowEmpty=%v, autoMerge=%v, expires=%d, labels_count=%d",
+func generatePullRequestConfig(max *string, defaultMax int, allowedLabels []string, allowEmpty *string, autoMerge *string, expires int) map[string]any {
+	safeOutputsConfigGenLog.Printf("Generating pull request config: max=%v, allowEmpty=%v, autoMerge=%v, expires=%d, labels_count=%d",
 		max, allowEmpty, autoMerge, expires, len(allowedLabels))
 	config := generateMaxConfig(max, defaultMax)
 	if len(allowedLabels) > 0 {
@@ -147,7 +154,7 @@ func generatePullRequestConfig(max int, defaultMax int, allowedLabels []string,
 }
 
 // generateHideCommentConfig creates a config with max and optional allowed_reasons
-func generateHideCommentConfig(max int, defaultMax int, allowedReasons []string) map[string]any {
+func generateHideCommentConfig(max *string, defaultMax int, allowedReasons []string) map[string]any {
 	config := generateMaxConfig(max, defaultMax)
 	if len(allowedReasons) > 0 {
 		config["allowed_reasons"] = allowedReasons
@@ -160,7 +167,7 @@ func generateHideCommentConfig(max int, defaultMax int, allowedReasons []string)
 // - "target-repo" uses hyphen to match frontmatter YAML format (key in config.json)
 // - "allowed_repos" uses underscore to match JavaScript handler expectations (see repo_helpers.cjs)
 // This inconsistency is intentional to maintain compatibility with existing handler code.
-func generateTargetConfigWithRepos(targetConfig SafeOutputTargetConfig, max int, defaultMax int, additionalFields map[string]any) map[string]any {
+func generateTargetConfigWithRepos(targetConfig SafeOutputTargetConfig, max *string, defaultMax int, additionalFields map[string]any) map[string]any {
 	config := generateMaxConfig(max, defaultMax)
 
 	// Add target if specified
diff --git a/pkg/workflow/safe_outputs_config_generation_test.go b/pkg/workflow/safe_outputs_config_generation_test.go
index e576e43c8e..6925d1c52d 100644
--- a/pkg/workflow/safe_outputs_config_generation_test.go
+++ b/pkg/workflow/safe_outputs_config_generation_test.go
@@ -34,7 +34,7 @@ jobs:
 	data := &WorkflowData{
 		SafeOutputs: &SafeOutputsConfig{
 			DispatchWorkflow: &DispatchWorkflowConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 2},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("2")},
 				Workflows:            []string{"ci"},
 				WorkflowFiles: map[string]string{
 					"ci": ".lock.yml",
@@ -64,7 +64,7 @@ func TestGenerateSafeOutputsConfigMissingToolWithIssue(t *testing.T) {
 	data := &WorkflowData{
 		SafeOutputs: &SafeOutputsConfig{
 			MissingTool: &MissingToolConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 				CreateIssue:          true,
 				TitlePrefix:          "[Missing Tool] ",
 				Labels:               []string{"bug"},
diff --git a/pkg/workflow/safe_outputs_config_helpers.go b/pkg/workflow/safe_outputs_config_helpers.go
index 5e18573c67..d388eb04e7 100644
--- a/pkg/workflow/safe_outputs_config_helpers.go
+++ b/pkg/workflow/safe_outputs_config_helpers.go
@@ -192,7 +192,7 @@ func applyDefaultCreateIssue(workflowData *WorkflowData) {
 	workflowID := workflowData.WorkflowID
 	safeOutputsConfigLog.Printf("Auto-injecting create-issues for workflow %q (no non-builtin safe outputs configured)", workflowID)
 	workflowData.SafeOutputs.CreateIssues = &CreateIssuesConfig{
-		BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+		BaseSafeOutputConfig: BaseSafeOutputConfig{Max: defaultIntStr(1)},
 		Labels:               []string{workflowID},
 		TitlePrefix:          fmt.Sprintf("[%s]", workflowID),
 	}
diff --git a/pkg/workflow/safe_outputs_default_create_issue_test.go b/pkg/workflow/safe_outputs_default_create_issue_test.go
index 5afd61934f..2301b9d131 100644
--- a/pkg/workflow/safe_outputs_default_create_issue_test.go
+++ b/pkg/workflow/safe_outputs_default_create_issue_test.go
@@ -243,7 +243,7 @@ func TestAutoInjectCreateIssue(t *testing.T) {
 			require.NotNil(t, workflowData.SafeOutputs, "SafeOutputs should not be nil after injection")
 			require.NotNil(t, workflowData.SafeOutputs.CreateIssues, "CreateIssues should be injected")
 
-			assert.Equal(t, 1, workflowData.SafeOutputs.CreateIssues.Max,
+			assert.Equal(t, strPtr("1"), workflowData.SafeOutputs.CreateIssues.Max,
 				"Injected create-issues should have max=1")
 			assert.Equal(t, []string{tt.expectedLabel}, workflowData.SafeOutputs.CreateIssues.Labels,
 				"Injected create-issues should have workflow ID as label")
@@ -267,7 +267,7 @@ func TestAutoInjectedCreateIssuePrompt(t *testing.T) {
 			name: "auto-injected create-issue produces specific prompt",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					Labels:               []string{"my-workflow"},
 					TitlePrefix:          "[my-workflow]",
 				},
diff --git a/pkg/workflow/safe_outputs_default_max_test.go b/pkg/workflow/safe_outputs_default_max_test.go
index 307fe66943..02cef18256 100644
--- a/pkg/workflow/safe_outputs_default_max_test.go
+++ b/pkg/workflow/safe_outputs_default_max_test.go
@@ -43,7 +43,7 @@ This workflow tests the default max for assign-to-agent.
 	// Verify assign-to-agent config exists and has default max of 1
 	require.NotNil(t, workflowData.SafeOutputs, "SafeOutputs should not be nil")
 	require.NotNil(t, workflowData.SafeOutputs.AssignToAgent, "AssignToAgent should not be nil")
-	assert.Equal(t, 1, workflowData.SafeOutputs.AssignToAgent.Max, "Default max should be 1")
+	assert.Equal(t, strPtr("1"), workflowData.SafeOutputs.AssignToAgent.Max, "Default max should be 1")
 }
 
 // TestDispatchWorkflowDefaultMax tests that dispatch-workflow has a default max of 1
@@ -95,7 +95,7 @@ This workflow tests the default max for dispatch-workflow.
 	// Verify dispatch-workflow config exists and has default max of 1
 	require.NotNil(t, workflowData.SafeOutputs, "SafeOutputs should not be nil")
 	require.NotNil(t, workflowData.SafeOutputs.DispatchWorkflow, "DispatchWorkflow should not be nil")
-	assert.Equal(t, 1, workflowData.SafeOutputs.DispatchWorkflow.Max, "Default max should be 1")
+	assert.Equal(t, strPtr("1"), workflowData.SafeOutputs.DispatchWorkflow.Max, "Default max should be 1")
 }
 
 // TestAssignToAgentExplicitMax tests that explicit max overrides the default
@@ -130,7 +130,7 @@ This workflow tests explicit max for assign-to-agent.
 	// Verify assign-to-agent config has explicit max of 5
 	require.NotNil(t, workflowData.SafeOutputs, "SafeOutputs should not be nil")
 	require.NotNil(t, workflowData.SafeOutputs.AssignToAgent, "AssignToAgent should not be nil")
-	assert.Equal(t, 5, workflowData.SafeOutputs.AssignToAgent.Max, "Explicit max should be 5")
+	assert.Equal(t, strPtr("5"), workflowData.SafeOutputs.AssignToAgent.Max, "Explicit max should be 5")
 }
 
 // TestDispatchWorkflowExplicitMax tests that explicit max overrides the default
@@ -184,23 +184,23 @@ This workflow tests explicit max for dispatch-workflow.
 	// Verify dispatch-workflow config has explicit max of 3
 	require.NotNil(t, workflowData.SafeOutputs, "SafeOutputs should not be nil")
 	require.NotNil(t, workflowData.SafeOutputs.DispatchWorkflow, "DispatchWorkflow should not be nil")
-	assert.Equal(t, 3, workflowData.SafeOutputs.DispatchWorkflow.Max, "Explicit max should be 3")
+	assert.Equal(t, strPtr("3"), workflowData.SafeOutputs.DispatchWorkflow.Max, "Explicit max should be 3")
 }
 
 // TestGenerateAssignToAgentConfigDefaultMax tests the config generation with default max
 func TestGenerateAssignToAgentConfigDefaultMax(t *testing.T) {
-	// Test with max=0 (should use default of 1)
-	config := generateAssignToAgentConfig(0, 1, "copilot", "", nil)
-	assert.Equal(t, 1, config["max"], "Should use default max of 1 when max is 0")
+	// Test with max=nil (should use default of 1)
+	config := generateAssignToAgentConfig(nil, 1, "copilot", "", nil)
+	assert.Equal(t, 1, config["max"], "Should use default max of 1 when max is nil")
 	assert.Equal(t, "copilot", config["default_agent"], "Should have default agent")
 
 	// Test with explicit max (should override default)
-	config = generateAssignToAgentConfig(5, 1, "copilot", "", nil)
+	config = generateAssignToAgentConfig(strPtr("5"), 1, "copilot", "", nil)
 	assert.Equal(t, 5, config["max"], "Should use explicit max of 5")
 	assert.Equal(t, "copilot", config["default_agent"], "Should have default agent")
 
 	// Test with target and allowed
-	config = generateAssignToAgentConfig(0, 1, "copilot", "issues", []string{"copilot", "custom"})
+	config = generateAssignToAgentConfig(nil, 1, "copilot", "issues", []string{"copilot", "custom"})
 	assert.Equal(t, 1, config["max"], "Should use default max of 1")
 	assert.Equal(t, "copilot", config["default_agent"], "Should have default agent")
 	assert.Equal(t, "issues", config["target"], "Should have target")
diff --git a/pkg/workflow/safe_outputs_env_test.go b/pkg/workflow/safe_outputs_env_test.go
index 3660960955..b16926aca3 100644
--- a/pkg/workflow/safe_outputs_env_test.go
+++ b/pkg/workflow/safe_outputs_env_test.go
@@ -51,7 +51,7 @@ func TestSafeOutputsEnvConfiguration(t *testing.T) {
 			Name:            "Test",
 			FrontmatterName: "Test Workflow",
 			SafeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 				Env: map[string]string{
 					"GITHUB_TOKEN": "${{ secrets.SOME_PAT_FOR_AGENTIC_WORKFLOWS }}",
 					"DEBUG_MODE":   "true",
@@ -76,7 +76,7 @@ func TestSafeOutputsEnvConfiguration(t *testing.T) {
 			Name:            "Test",
 			FrontmatterName: "Test Workflow",
 			SafeOutputs: &SafeOutputsConfig{
-				CreatePullRequests: &CreatePullRequestsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreatePullRequests: &CreatePullRequestsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 				Env: map[string]string{
 					"GITHUB_TOKEN": "${{ secrets.SOME_PAT_FOR_AGENTIC_WORKFLOWS }}",
 					"API_ENDPOINT": "https://api.example.com",
diff --git a/pkg/workflow/safe_outputs_footer_test.go b/pkg/workflow/safe_outputs_footer_test.go
index 4299f9e4c7..aa208e58c6 100644
--- a/pkg/workflow/safe_outputs_footer_test.go
+++ b/pkg/workflow/safe_outputs_footer_test.go
@@ -150,7 +150,7 @@ func TestFooterInHandlerConfig(t *testing.T) {
 		Name: "Test",
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				Footer:               testStringPtr("false"),
 			},
 		},
diff --git a/pkg/workflow/safe_outputs_import_test.go b/pkg/workflow/safe_outputs_import_test.go
index 2d8f098567..228d030d23 100644
--- a/pkg/workflow/safe_outputs_import_test.go
+++ b/pkg/workflow/safe_outputs_import_test.go
@@ -140,7 +140,7 @@ imports:
 	assert.Equal(t, []string{"bug"}, workflowData.SafeOutputs.CreateIssues.Labels)
 
 	require.NotNil(t, workflowData.SafeOutputs.AddComments, "AddComments should be imported")
-	assert.Equal(t, 3, workflowData.SafeOutputs.AddComments.Max)
+	assert.Equal(t, strPtr("3"), workflowData.SafeOutputs.AddComments.Max)
 }
 
 // TestSafeOutputsImportOverride tests that when the same safe-output type is defined in both main and imported workflow, the main workflow's definition takes precedence
@@ -409,7 +409,7 @@ imports:
 	assert.Equal(t, "[issue] ", workflowData.SafeOutputs.CreateIssues.TitlePrefix)
 
 	require.NotNil(t, workflowData.SafeOutputs.AddComments, "AddComments should be imported from second shared workflow")
-	assert.Equal(t, 5, workflowData.SafeOutputs.AddComments.Max)
+	assert.Equal(t, strPtr("5"), workflowData.SafeOutputs.AddComments.Max)
 }
 
 // TestMergeSafeOutputsUnit tests the MergeSafeOutputs function directly
@@ -1345,7 +1345,7 @@ func TestMergeSafeOutputsJobsSkippedWhenEmpty(t *testing.T) {
 	// Other safe-output types should be merged
 	require.NotNil(t, result.CreateIssues, "CreateIssues should be preserved")
 	require.NotNil(t, result.AddComments, "AddComments should be merged")
-	assert.Equal(t, 5, result.AddComments.Max, "AddComments config should be correct")
+	assert.Equal(t, strPtr("5"), result.AddComments.Max, "AddComments config should be correct")
 }
 
 // TestMergeSafeOutputsErrorPropagation tests error propagation from mergeSafeOutputConfig
@@ -1549,17 +1549,17 @@ This workflow uses the imported project safe-output configuration.
 
 	// Verify update-project configuration was imported correctly
 	require.NotNil(t, workflowData.SafeOutputs.UpdateProjects, "UpdateProjects configuration should be imported")
-	assert.Equal(t, 100, workflowData.SafeOutputs.UpdateProjects.Max)
+	assert.Equal(t, strPtr("100"), workflowData.SafeOutputs.UpdateProjects.Max)
 	assert.Equal(t, "${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}", workflowData.SafeOutputs.UpdateProjects.GitHubToken)
 
 	// Verify create-project-status-update configuration was imported correctly (the bug fix)
 	require.NotNil(t, workflowData.SafeOutputs.CreateProjectStatusUpdates, "CreateProjectStatusUpdates configuration should be imported")
-	assert.Equal(t, 1, workflowData.SafeOutputs.CreateProjectStatusUpdates.Max)
+	assert.Equal(t, strPtr("1"), workflowData.SafeOutputs.CreateProjectStatusUpdates.Max)
 	assert.Equal(t, "${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}", workflowData.SafeOutputs.CreateProjectStatusUpdates.GitHubToken)
 
 	// Verify create-project configuration was imported correctly
 	require.NotNil(t, workflowData.SafeOutputs.CreateProjects, "CreateProjects configuration should be imported")
-	assert.Equal(t, 5, workflowData.SafeOutputs.CreateProjects.Max)
+	assert.Equal(t, strPtr("5"), workflowData.SafeOutputs.CreateProjects.Max)
 	assert.Equal(t, "${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}", workflowData.SafeOutputs.CreateProjects.GitHubToken)
 }
 
@@ -1636,28 +1636,28 @@ This workflow uses the imported safe-output configuration for previously missing
 
 	// Verify all previously missing types are now imported correctly
 	require.NotNil(t, workflowData.SafeOutputs.UpdateDiscussions, "UpdateDiscussions should be imported")
-	assert.Equal(t, 10, workflowData.SafeOutputs.UpdateDiscussions.Max)
+	assert.Equal(t, strPtr("10"), workflowData.SafeOutputs.UpdateDiscussions.Max)
 
 	require.NotNil(t, workflowData.SafeOutputs.LinkSubIssue, "LinkSubIssue should be imported")
-	assert.Equal(t, 5, workflowData.SafeOutputs.LinkSubIssue.Max)
+	assert.Equal(t, strPtr("5"), workflowData.SafeOutputs.LinkSubIssue.Max)
 
 	require.NotNil(t, workflowData.SafeOutputs.HideComment, "HideComment should be imported")
-	assert.Equal(t, 20, workflowData.SafeOutputs.HideComment.Max)
+	assert.Equal(t, strPtr("20"), workflowData.SafeOutputs.HideComment.Max)
 
 	require.NotNil(t, workflowData.SafeOutputs.DispatchWorkflow, "DispatchWorkflow should be imported")
-	assert.Equal(t, 3, workflowData.SafeOutputs.DispatchWorkflow.Max)
+	assert.Equal(t, strPtr("3"), workflowData.SafeOutputs.DispatchWorkflow.Max)
 
 	require.NotNil(t, workflowData.SafeOutputs.AssignToUser, "AssignToUser should be imported")
-	assert.Equal(t, 15, workflowData.SafeOutputs.AssignToUser.Max)
+	assert.Equal(t, strPtr("15"), workflowData.SafeOutputs.AssignToUser.Max)
 
 	require.NotNil(t, workflowData.SafeOutputs.AutofixCodeScanningAlert, "AutofixCodeScanningAlert should be imported")
-	assert.Equal(t, 8, workflowData.SafeOutputs.AutofixCodeScanningAlert.Max)
+	assert.Equal(t, strPtr("8"), workflowData.SafeOutputs.AutofixCodeScanningAlert.Max)
 
 	require.NotNil(t, workflowData.SafeOutputs.MarkPullRequestAsReadyForReview, "MarkPullRequestAsReadyForReview should be imported")
-	assert.Equal(t, 12, workflowData.SafeOutputs.MarkPullRequestAsReadyForReview.Max)
+	assert.Equal(t, strPtr("12"), workflowData.SafeOutputs.MarkPullRequestAsReadyForReview.Max)
 
 	require.NotNil(t, workflowData.SafeOutputs.MissingData, "MissingData should be imported")
-	assert.Equal(t, 2, workflowData.SafeOutputs.MissingData.Max)
+	assert.Equal(t, strPtr("2"), workflowData.SafeOutputs.MissingData.Max)
 }
 
 // TestSafeOutputsImportMessagesAllFields tests that all message fields can be imported correctly
diff --git a/pkg/workflow/safe_outputs_integration_test.go b/pkg/workflow/safe_outputs_integration_test.go
index cf2f3d9599..e672d9b069 100644
--- a/pkg/workflow/safe_outputs_integration_test.go
+++ b/pkg/workflow/safe_outputs_integration_test.go
@@ -74,7 +74,7 @@ func TestSafeOutputJobsIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					AddComments: &AddCommentsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 5,
+							Max: strPtr("5"),
 						},
 					},
 				}
@@ -106,7 +106,7 @@ func TestSafeOutputJobsIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					MissingTool: &MissingToolConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 10,
+							Max: strPtr("10"),
 						},
 					},
 				}
@@ -123,7 +123,7 @@ func TestSafeOutputJobsIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 10,
+							Max: strPtr("10"),
 						},
 					},
 				}
@@ -140,7 +140,7 @@ func TestSafeOutputJobsIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 10,
+							Max: strPtr("10"),
 						},
 					},
 				}
@@ -157,7 +157,7 @@ func TestSafeOutputJobsIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					CreateAgentSessions: &CreateAgentSessionConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 5,
+							Max: strPtr("5"),
 						},
 					},
 				}
@@ -174,7 +174,7 @@ func TestSafeOutputJobsIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					UploadAssets: &UploadAssetsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 10,
+							Max: strPtr("10"),
 						},
 					},
 				}
@@ -266,7 +266,7 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					NoOp: &NoOpConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 1,
+							Max: strPtr("1"),
 						},
 					},
 				}
@@ -282,7 +282,7 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					PushToPullRequestBranch: &PushToPullRequestBranchConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 1,
+							Max: strPtr("1"),
 						},
 					},
 				}
@@ -299,7 +299,7 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 					UpdateIssues: &UpdateIssuesConfig{
 						UpdateEntityConfig: UpdateEntityConfig{
 							BaseSafeOutputConfig: BaseSafeOutputConfig{
-								Max: 1,
+								Max: strPtr("1"),
 							},
 						},
 					},
@@ -317,7 +317,7 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 					UpdatePullRequests: &UpdatePullRequestsConfig{
 						UpdateEntityConfig: UpdateEntityConfig{
 							BaseSafeOutputConfig: BaseSafeOutputConfig{
-								Max: 1,
+								Max: strPtr("1"),
 							},
 						},
 					},
@@ -335,7 +335,7 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 					UpdateDiscussions: &UpdateDiscussionsConfig{
 						UpdateEntityConfig: UpdateEntityConfig{
 							BaseSafeOutputConfig: BaseSafeOutputConfig{
-								Max: 1,
+								Max: strPtr("1"),
 							},
 						},
 					},
@@ -364,7 +364,7 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 				return &SafeOutputsConfig{
 					ClosePullRequests: &ClosePullRequestsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 1,
+							Max: strPtr("1"),
 						},
 					},
 				}
@@ -459,7 +459,7 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 					UpdateRelease: &UpdateReleaseConfig{
 						UpdateEntityConfig: UpdateEntityConfig{
 							BaseSafeOutputConfig: BaseSafeOutputConfig{
-								Max: 1,
+								Max: strPtr("1"),
 							},
 						},
 					},
@@ -482,12 +482,12 @@ func TestConsolidatedSafeOutputsJobIntegration(t *testing.T) {
 					},
 					AddComments: &AddCommentsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 5,
+							Max: strPtr("5"),
 						},
 					},
 					NoOp: &NoOpConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 1,
+							Max: strPtr("1"),
 						},
 					},
 					Env: map[string]string{
@@ -654,7 +654,7 @@ func TestSafeOutputJobsWithCustomEnvVars(t *testing.T) {
 				return &SafeOutputsConfig{
 					AddComments: &AddCommentsConfig{
 						BaseSafeOutputConfig: BaseSafeOutputConfig{
-							Max: 5,
+							Max: strPtr("5"),
 						},
 					},
 					Env: map[string]string{
@@ -779,13 +779,13 @@ func TestConsolidatedSafeOutputsJobWithCustomEnv(t *testing.T) {
 		SafeOutputs: &SafeOutputsConfig{
 			NoOp: &NoOpConfig{
 				BaseSafeOutputConfig: BaseSafeOutputConfig{
-					Max: 1,
+					Max: strPtr("1"),
 				},
 			},
 			UpdateIssues: &UpdateIssuesConfig{
 				UpdateEntityConfig: UpdateEntityConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{
-						Max: 1,
+						Max: strPtr("1"),
 					},
 				},
 			},
diff --git a/pkg/workflow/safe_outputs_max_test.go b/pkg/workflow/safe_outputs_max_test.go
index 88e3bf0053..271ee9b46a 100644
--- a/pkg/workflow/safe_outputs_max_test.go
+++ b/pkg/workflow/safe_outputs_max_test.go
@@ -27,29 +27,29 @@ func TestSafeOutputsMaxConfiguration(t *testing.T) {
 		if config.CreateIssues == nil {
 			t.Fatal("Expected CreateIssues to be parsed")
 		}
-		if config.CreateIssues.Max != 1 {
-			t.Errorf("Expected CreateIssues.Max to be 1 by default, got %d", config.CreateIssues.Max)
+		if templatableIntValue(config.CreateIssues.Max) != 1 {
+			t.Errorf("Expected CreateIssues.Max to be 1 by default, got %v", config.CreateIssues.Max)
 		}
 
 		if config.AddComments == nil {
 			t.Fatal("Expected AddComments to be parsed")
 		}
-		if config.AddComments.Max != 1 {
-			t.Errorf("Expected AddComments.Max to be 1 by default, got %d", config.AddComments.Max)
+		if templatableIntValue(config.AddComments.Max) != 1 {
+			t.Errorf("Expected AddComments.Max to be 1 by default, got %v", config.AddComments.Max)
 		}
 
 		if config.CreatePullRequests == nil {
 			t.Fatal("Expected CreatePullRequests to be parsed")
 		}
-		if config.CreatePullRequests.Max != 1 {
-			t.Errorf("Expected CreatePullRequests.Max to be 1 by default, got %d", config.CreatePullRequests.Max)
+		if templatableIntValue(config.CreatePullRequests.Max) != 1 {
+			t.Errorf("Expected CreatePullRequests.Max to be 1 by default, got %v", config.CreatePullRequests.Max)
 		}
 
 		if config.UpdateIssues == nil {
 			t.Fatal("Expected UpdateIssues to be parsed")
 		}
-		if config.UpdateIssues.Max != 1 {
-			t.Errorf("Expected UpdateIssues.Max to be 1 by default, got %d", config.UpdateIssues.Max)
+		if templatableIntValue(config.UpdateIssues.Max) != 1 {
+			t.Errorf("Expected UpdateIssues.Max to be 1 by default, got %v", config.UpdateIssues.Max)
 		}
 	})
 
@@ -80,29 +80,29 @@ func TestSafeOutputsMaxConfiguration(t *testing.T) {
 		if config.CreateIssues == nil {
 			t.Fatal("Expected CreateIssues to be parsed")
 		}
-		if config.CreateIssues.Max != 3 {
-			t.Errorf("Expected CreateIssues.Max to be 3, got %d", config.CreateIssues.Max)
+		if templatableIntValue(config.CreateIssues.Max) != 3 {
+			t.Errorf("Expected CreateIssues.Max to be 3, got %v", config.CreateIssues.Max)
 		}
 
 		if config.AddComments == nil {
 			t.Fatal("Expected AddComments to be parsed")
 		}
-		if config.AddComments.Max != 5 {
-			t.Errorf("Expected AddComments.Max to be 5, got %d", config.AddComments.Max)
+		if templatableIntValue(config.AddComments.Max) != 5 {
+			t.Errorf("Expected AddComments.Max to be 5, got %v", config.AddComments.Max)
 		}
 
 		if config.CreatePullRequests == nil {
 			t.Fatal("Expected CreatePullRequests to be parsed")
 		}
-		if config.CreatePullRequests.Max != 2 {
-			t.Errorf("Expected CreatePullRequests.Max to be 2, got %d", config.CreatePullRequests.Max)
+		if templatableIntValue(config.CreatePullRequests.Max) != 2 {
+			t.Errorf("Expected CreatePullRequests.Max to be 2, got %v", config.CreatePullRequests.Max)
 		}
 
 		if config.UpdateIssues == nil {
 			t.Fatal("Expected UpdateIssues to be parsed")
 		}
-		if config.UpdateIssues.Max != 4 {
-			t.Errorf("Expected UpdateIssues.Max to be 4, got %d", config.UpdateIssues.Max)
+		if templatableIntValue(config.UpdateIssues.Max) != 4 {
+			t.Errorf("Expected UpdateIssues.Max to be 4, got %v", config.UpdateIssues.Max)
 		}
 	})
 
@@ -142,8 +142,8 @@ func TestSafeOutputsMaxConfiguration(t *testing.T) {
 		if config.CreateIssues == nil {
 			t.Fatal("Expected CreateIssues to be parsed")
 		}
-		if config.CreateIssues.Max != 2 {
-			t.Errorf("Expected CreateIssues.Max to be 2, got %d", config.CreateIssues.Max)
+		if templatableIntValue(config.CreateIssues.Max) != 2 {
+			t.Errorf("Expected CreateIssues.Max to be 2, got %v", config.CreateIssues.Max)
 		}
 		if config.CreateIssues.TitlePrefix != "[Auto] " {
 			t.Errorf("Expected CreateIssues.TitlePrefix to be '[Auto] ', got '%s'", config.CreateIssues.TitlePrefix)
@@ -156,8 +156,8 @@ func TestSafeOutputsMaxConfiguration(t *testing.T) {
 		if config.AddComments == nil {
 			t.Fatal("Expected AddComments to be parsed")
 		}
-		if config.AddComments.Max != 3 {
-			t.Errorf("Expected AddComments.Max to be 3, got %d", config.AddComments.Max)
+		if templatableIntValue(config.AddComments.Max) != 3 {
+			t.Errorf("Expected AddComments.Max to be 3, got %v", config.AddComments.Max)
 		}
 		if config.AddComments.Target != "*" {
 			t.Errorf("Expected AddComments.Target to be '*', got '%s'", config.AddComments.Target)
@@ -167,8 +167,8 @@ func TestSafeOutputsMaxConfiguration(t *testing.T) {
 		if config.CreatePullRequests == nil {
 			t.Fatal("Expected CreatePullRequests to be parsed")
 		}
-		if config.CreatePullRequests.Max != 1 {
-			t.Errorf("Expected CreatePullRequests.Max to be 1, got %d", config.CreatePullRequests.Max)
+		if templatableIntValue(config.CreatePullRequests.Max) != 1 {
+			t.Errorf("Expected CreatePullRequests.Max to be 1, got %v", config.CreatePullRequests.Max)
 		}
 		if config.CreatePullRequests.TitlePrefix != "[Fix] " {
 			t.Errorf("Expected CreatePullRequests.TitlePrefix to be '[Fix] ', got '%s'", config.CreatePullRequests.TitlePrefix)
@@ -184,8 +184,8 @@ func TestSafeOutputsMaxConfiguration(t *testing.T) {
 		if config.UpdateIssues == nil {
 			t.Fatal("Expected UpdateIssues to be parsed")
 		}
-		if config.UpdateIssues.Max != 2 {
-			t.Errorf("Expected UpdateIssues.Max to be 2, got %d", config.UpdateIssues.Max)
+		if templatableIntValue(config.UpdateIssues.Max) != 2 {
+			t.Errorf("Expected UpdateIssues.Max to be 2, got %v", config.UpdateIssues.Max)
 		}
 		if config.UpdateIssues.Target != "456" {
 			t.Errorf("Expected UpdateIssues.Target to be '456', got '%s'", config.UpdateIssues.Target)
diff --git a/pkg/workflow/safe_outputs_messages_test.go b/pkg/workflow/safe_outputs_messages_test.go
index 67af43aff2..73a4e1472c 100644
--- a/pkg/workflow/safe_outputs_messages_test.go
+++ b/pkg/workflow/safe_outputs_messages_test.go
@@ -202,7 +202,7 @@ func TestMessagesEnvVarInSafeOutputJobs(t *testing.T) {
 			Name:            "Test",
 			FrontmatterName: "Test Workflow",
 			SafeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 				Messages: &SafeOutputMessagesConfig{
 					Footer: "> Custom footer [{workflow_name}]({run_url})",
 				},
@@ -230,7 +230,7 @@ func TestMessagesEnvVarInSafeOutputJobs(t *testing.T) {
 			Name:            "Test",
 			FrontmatterName: "Test Workflow",
 			SafeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			},
 		}
 
diff --git a/pkg/workflow/safe_outputs_permissions_test.go b/pkg/workflow/safe_outputs_permissions_test.go
index 9ea26f0dc8..a1da8d8c12 100644
--- a/pkg/workflow/safe_outputs_permissions_test.go
+++ b/pkg/workflow/safe_outputs_permissions_test.go
@@ -24,7 +24,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "create-issue only - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -36,7 +36,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "create-discussion requires discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				CreateDiscussions: &CreateDiscussionsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -49,7 +49,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "close-discussion requires discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				CloseDiscussions: &CloseDiscussionsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -62,7 +62,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				UpdateDiscussions: &UpdateDiscussionsConfig{
 					UpdateEntityConfig: UpdateEntityConfig{
-						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					},
 				},
 			},
@@ -75,7 +75,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "add-comment default - includes discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				AddComments: &AddCommentsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -88,7 +88,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "add-comment with discussions:false - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				AddComments: &AddCommentsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					Discussions:          ptrBool(false),
 				},
 			},
@@ -101,7 +101,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "hide-comment default - includes discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				HideComment: &HideCommentConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -114,7 +114,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "hide-comment with discussions:false - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				HideComment: &HideCommentConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					Discussions:          ptrBool(false),
 				},
 			},
@@ -127,7 +127,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "add-labels only - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				AddLabels: &AddLabelsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -140,7 +140,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "remove-labels only - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				RemoveLabels: &RemoveLabelsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 2},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("2")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -153,7 +153,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "close-issue only - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				CloseIssues: &CloseIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -165,7 +165,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "close-pull-request only - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				ClosePullRequests: &ClosePullRequestsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -177,7 +177,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "create-pull-request with fallback-as-issue (default) - includes issues permission",
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequests: &CreatePullRequestsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -190,7 +190,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "create-pull-request with fallback-as-issue false - no issues permission",
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequests: &CreatePullRequestsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					FallbackAsIssue:      boolPtr(false),
 				},
 			},
@@ -215,13 +215,13 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "multiple safe outputs without discussions - no discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 				AddLabels: &AddLabelsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 				AssignToUser: &AssignToUserConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -234,13 +234,13 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "multiple safe outputs with one discussion - includes discussions permission",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 				CreateDiscussions: &CreateDiscussionsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 				AddLabels: &AddLabelsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -254,7 +254,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "upload-asset requires contents write",
 			safeOutputs: &SafeOutputsConfig{
 				UploadAssets: &UploadAssetsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -265,7 +265,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "create-code-scanning-alert requires security-events write",
 			safeOutputs: &SafeOutputsConfig{
 				CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -277,7 +277,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "autofix-code-scanning-alert requires security-events and actions",
 			safeOutputs: &SafeOutputsConfig{
 				AutofixCodeScanningAlert: &AutofixCodeScanningAlertConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -290,7 +290,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "dispatch-workflow requires actions write",
 			safeOutputs: &SafeOutputsConfig{
 				DispatchWorkflow: &DispatchWorkflowConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -301,7 +301,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			name: "create-project requires organization-projects write",
 			safeOutputs: &SafeOutputsConfig{
 				CreateProjects: &CreateProjectsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
@@ -337,10 +337,10 @@ func TestComputePermissionsForSafeOutputs_NoOpAndMissingTool(t *testing.T) {
 	// They rely on add-comment permissions if comments are needed
 	safeOutputs := &SafeOutputsConfig{
 		NoOp: &NoOpConfig{
-			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 		},
 		MissingTool: &MissingToolConfig{
-			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 		},
 	}
 
diff --git a/pkg/workflow/safe_outputs_test.go b/pkg/workflow/safe_outputs_test.go
index 8bac53c353..66966bb5e2 100644
--- a/pkg/workflow/safe_outputs_test.go
+++ b/pkg/workflow/safe_outputs_test.go
@@ -509,7 +509,7 @@ func TestGenerateSafeOutputsConfig(t *testing.T) {
 			workflowData: &WorkflowData{
 				SafeOutputs: &SafeOutputsConfig{
 					CreateIssues: &CreateIssuesConfig{
-						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 					},
 				},
 			},
@@ -520,7 +520,7 @@ func TestGenerateSafeOutputsConfig(t *testing.T) {
 			workflowData: &WorkflowData{
 				SafeOutputs: &SafeOutputsConfig{
 					CreateAgentSessions: &CreateAgentSessionConfig{
-						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 					},
 				},
 			},
@@ -531,7 +531,7 @@ func TestGenerateSafeOutputsConfig(t *testing.T) {
 			workflowData: &WorkflowData{
 				SafeOutputs: &SafeOutputsConfig{
 					AddComments: &AddCommentsConfig{
-						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 2},
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("2")},
 						Target:               "issue",
 					},
 				},
@@ -542,10 +542,10 @@ func TestGenerateSafeOutputsConfig(t *testing.T) {
 			name: "multiple safe outputs",
 			workflowData: &WorkflowData{
 				SafeOutputs: &SafeOutputsConfig{
-					CreateIssues:       &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
-					AddComments:        &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3}},
+					CreateIssues:       &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
+					AddComments:        &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")}},
 					CreatePullRequests: &CreatePullRequestsConfig{},
-					AddLabels:          &AddLabelsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5}},
+					AddLabels:          &AddLabelsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")}},
 				},
 			},
 			expectedKeys: []string{"create_issue", "add_comment", "create_pull_request", "add_labels"},
@@ -569,7 +569,7 @@ func TestGenerateSafeOutputsConfig(t *testing.T) {
 			workflowData: &WorkflowData{
 				SafeOutputs: &SafeOutputsConfig{
 					CloseDiscussions: &CloseDiscussionsConfig{
-						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 						SafeOutputDiscussionFilterConfig: SafeOutputDiscussionFilterConfig{
 							RequiredCategory: "general",
 							SafeOutputFilterConfig: SafeOutputFilterConfig{
@@ -586,7 +586,7 @@ func TestGenerateSafeOutputsConfig(t *testing.T) {
 			name: "noop config",
 			workflowData: &WorkflowData{
 				SafeOutputs: &SafeOutputsConfig{
-					NoOp: &NoOpConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+					NoOp: &NoOpConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 				},
 			},
 			expectedKeys: []string{"noop"},
@@ -596,7 +596,7 @@ func TestGenerateSafeOutputsConfig(t *testing.T) {
 			workflowData: &WorkflowData{
 				SafeOutputs: &SafeOutputsConfig{
 					UpdateProjects: &UpdateProjectConfig{
-						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 					},
 				},
 			},
diff --git a/pkg/workflow/safe_outputs_tools_test.go b/pkg/workflow/safe_outputs_tools_test.go
index c4fbcbc16c..4cc4edf3c6 100644
--- a/pkg/workflow/safe_outputs_tools_test.go
+++ b/pkg/workflow/safe_outputs_tools_test.go
@@ -30,7 +30,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "create issues enabled",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 			},
 			expectedTools: []string{"create_issue"},
@@ -39,7 +39,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "create agent sessions enabled",
 			safeOutputs: &SafeOutputsConfig{
 				CreateAgentSessions: &CreateAgentSessionConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 				},
 			},
 			expectedTools: []string{"create_agent_session"},
@@ -48,7 +48,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "create discussions enabled",
 			safeOutputs: &SafeOutputsConfig{
 				CreateDiscussions: &CreateDiscussionsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 2},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("2")},
 				},
 			},
 			expectedTools: []string{"create_discussion"},
@@ -57,7 +57,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "add comments enabled",
 			safeOutputs: &SafeOutputsConfig{
 				AddComments: &AddCommentsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 				},
 			},
 			expectedTools: []string{"add_comment"},
@@ -73,7 +73,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "create pull request review comments enabled",
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 			},
 			expectedTools: []string{"create_pull_request_review_comment"},
@@ -82,7 +82,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "submit pull request review enabled",
 			safeOutputs: &SafeOutputsConfig{
 				SubmitPullRequestReview: &SubmitPullRequestReviewConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expectedTools: []string{"submit_pull_request_review"},
@@ -91,7 +91,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "reply to pull request review comment enabled",
 			safeOutputs: &SafeOutputsConfig{
 				ReplyToPullRequestReviewComment: &ReplyToPullRequestReviewCommentConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 				},
 			},
 			expectedTools: []string{"reply_to_pull_request_review_comment"},
@@ -100,7 +100,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "resolve pull request review thread enabled",
 			safeOutputs: &SafeOutputsConfig{
 				ResolvePullRequestReviewThread: &ResolvePullRequestReviewThreadConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 				},
 			},
 			expectedTools: []string{"resolve_pull_request_review_thread"},
@@ -109,7 +109,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "create code scanning alerts enabled",
 			safeOutputs: &SafeOutputsConfig{
 				CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 100},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("100")},
 				},
 			},
 			expectedTools: []string{"create_code_scanning_alert"},
@@ -118,7 +118,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "add labels enabled",
 			safeOutputs: &SafeOutputsConfig{
 				AddLabels: &AddLabelsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 			},
 			expectedTools: []string{"add_labels"},
@@ -128,7 +128,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			safeOutputs: &SafeOutputsConfig{
 				UpdateIssues: &UpdateIssuesConfig{
 					UpdateEntityConfig: UpdateEntityConfig{
-						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 					},
 				},
 			},
@@ -138,7 +138,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "push to pull request branch enabled",
 			safeOutputs: &SafeOutputsConfig{
 				PushToPullRequestBranch: &PushToPullRequestBranchConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			expectedTools: []string{"push_to_pull_request_branch"},
@@ -147,7 +147,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "upload assets enabled",
 			safeOutputs: &SafeOutputsConfig{
 				UploadAssets: &UploadAssetsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 				},
 			},
 			expectedTools: []string{"upload_asset"},
@@ -156,7 +156,7 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 			name: "missing tool enabled",
 			safeOutputs: &SafeOutputsConfig{
 				MissingTool: &MissingToolConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 			},
 			expectedTools: []string{"missing_tool"},
@@ -164,31 +164,31 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 		{
 			name: "multiple tools enabled",
 			safeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5}},
-				AddComments:  &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10}},
-				AddLabels:    &AddLabelsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")}},
+				AddComments:  &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")}},
+				AddLabels:    &AddLabelsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")}},
 			},
 			expectedTools: []string{"create_issue", "add_comment", "add_labels"},
 		},
 		{
 			name: "all tools enabled",
 			safeOutputs: &SafeOutputsConfig{
-				CreateIssues:                    &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5}},
-				CreateAgentSessions:             &CreateAgentSessionConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3}},
-				CreateDiscussions:               &CreateDiscussionsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 2}},
-				AddComments:                     &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10}},
+				CreateIssues:                    &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")}},
+				CreateAgentSessions:             &CreateAgentSessionConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")}},
+				CreateDiscussions:               &CreateDiscussionsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("2")}},
+				AddComments:                     &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")}},
 				CreatePullRequests:              &CreatePullRequestsConfig{},
-				CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5}},
-				SubmitPullRequestReview:         &SubmitPullRequestReviewConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
-				ReplyToPullRequestReviewComment: &ReplyToPullRequestReviewCommentConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10}},
-				ResolvePullRequestReviewThread:  &ResolvePullRequestReviewThreadConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10}},
-				CreateCodeScanningAlerts:        &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 100}},
-				AddLabels:                       &AddLabelsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3}},
-				AddReviewer:                     &AddReviewerConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3}},
-				UpdateIssues:                    &UpdateIssuesConfig{UpdateEntityConfig: UpdateEntityConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3}}},
-				PushToPullRequestBranch:         &PushToPullRequestBranchConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
-				UploadAssets:                    &UploadAssetsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10}},
-				MissingTool:                     &MissingToolConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5}},
+				CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")}},
+				SubmitPullRequestReview:         &SubmitPullRequestReviewConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
+				ReplyToPullRequestReviewComment: &ReplyToPullRequestReviewCommentConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")}},
+				ResolvePullRequestReviewThread:  &ResolvePullRequestReviewThreadConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")}},
+				CreateCodeScanningAlerts:        &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("100")}},
+				AddLabels:                       &AddLabelsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")}},
+				AddReviewer:                     &AddReviewerConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")}},
+				UpdateIssues:                    &UpdateIssuesConfig{UpdateEntityConfig: UpdateEntityConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")}}},
+				PushToPullRequestBranch:         &PushToPullRequestBranchConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
+				UploadAssets:                    &UploadAssetsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")}},
+				MissingTool:                     &MissingToolConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")}},
 			},
 			expectedTools: []string{
 				"create_issue",
@@ -249,8 +249,8 @@ func TestGenerateFilteredToolsJSON(t *testing.T) {
 func TestGenerateFilteredToolsJSONValidStructure(t *testing.T) {
 	workflowData := &WorkflowData{
 		SafeOutputs: &SafeOutputsConfig{
-			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5}},
-			AddComments:  &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10}},
+			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")}},
+			AddComments:  &AddCommentsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")}},
 		},
 	}
 
@@ -392,7 +392,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			baseDescription: "Create a new GitHub issue.",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				},
 			},
 			wantContains:    []string{"CONSTRAINTS:", "Maximum 5 issue(s)"},
@@ -426,7 +426,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			baseDescription: "Create a new GitHub issue.",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 					TitlePrefix:          "[bot] ",
 					Labels:               []string{"automated"},
 					TargetRepoSlug:       "owner/repo",
@@ -446,7 +446,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			baseDescription: "Add labels to an issue.",
 			safeOutputs: &SafeOutputsConfig{
 				AddLabels: &AddLabelsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 					Allowed:              []string{"bug", "enhancement", "question"},
 				},
 			},
@@ -476,7 +476,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			baseDescription: "Manage GitHub Projects.",
 			safeOutputs: &SafeOutputsConfig{
 				UpdateProjects: &UpdateProjectConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 				},
 			},
 			wantContains: []string{
@@ -504,7 +504,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			baseDescription: "Manage GitHub Projects.",
 			safeOutputs: &SafeOutputsConfig{
 				UpdateProjects: &UpdateProjectConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 					Project:              "https://github.com/users/username/projects/1",
 				},
 			},
@@ -520,7 +520,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			baseDescription: "Post a status update to a GitHub Project.",
 			safeOutputs: &SafeOutputsConfig{
 				CreateProjectStatusUpdates: &CreateProjectStatusUpdateConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 				},
 			},
 			wantContains: []string{
@@ -548,7 +548,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			baseDescription: "Post a status update to a GitHub Project.",
 			safeOutputs: &SafeOutputsConfig{
 				CreateProjectStatusUpdates: &CreateProjectStatusUpdateConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 8},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("8")},
 					Project:              "https://github.com/orgs/example/projects/50",
 				},
 			},
@@ -573,7 +573,7 @@ func TestEnhanceToolDescription(t *testing.T) {
 			toolName:        "unknown_tool",
 			baseDescription: "Unknown tool.",
 			safeOutputs: &SafeOutputsConfig{
-				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5}},
+				CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")}},
 			},
 			wantContains:    []string{"Unknown tool."},
 			wantNotContains: []string{"CONSTRAINTS:"},
@@ -599,12 +599,12 @@ func TestGenerateFilteredToolsJSONWithEnhancedDescriptions(t *testing.T) {
 	workflowData := &WorkflowData{
 		SafeOutputs: &SafeOutputsConfig{
 			CreateIssues: &CreateIssuesConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 				TitlePrefix:          "[automated] ",
 				Labels:               []string{"bot", "enhancement"},
 			},
 			AddLabels: &AddLabelsConfig{
-				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 3},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("3")},
 				Allowed:              []string{"bug", "enhancement"},
 			},
 		},
@@ -663,7 +663,7 @@ func TestRepoParameterAddedOnlyWithAllowedRepos(t *testing.T) {
 			name: "create_issue without allowed-repos should not have repo parameter",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					TargetRepoSlug:       "org/target-repo",
 				},
 			},
@@ -674,7 +674,7 @@ func TestRepoParameterAddedOnlyWithAllowedRepos(t *testing.T) {
 			name: "create_issue with allowed-repos should have repo parameter",
 			safeOutputs: &SafeOutputsConfig{
 				CreateIssues: &CreateIssuesConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					TargetRepoSlug:       "org/target-repo",
 					AllowedRepos:         []string{"org/other-repo"},
 				},
@@ -687,7 +687,7 @@ func TestRepoParameterAddedOnlyWithAllowedRepos(t *testing.T) {
 			name: "add_comment with allowed-repos should have repo parameter",
 			safeOutputs: &SafeOutputsConfig{
 				AddComments: &AddCommentsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 5},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("5")},
 					AllowedRepos:         []string{"org/repo-a", "org/repo-b"},
 				},
 			},
@@ -698,7 +698,7 @@ func TestRepoParameterAddedOnlyWithAllowedRepos(t *testing.T) {
 			name: "create_pull_request without allowed-repos should not have repo parameter",
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequests: &CreatePullRequestsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 			toolName:   "create_pull_request",
@@ -708,7 +708,7 @@ func TestRepoParameterAddedOnlyWithAllowedRepos(t *testing.T) {
 			name: "create_pull_request with allowed-repos should have repo parameter",
 			safeOutputs: &SafeOutputsConfig{
 				CreatePullRequests: &CreatePullRequestsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					AllowedRepos:         []string{"org/repo-c"},
 				},
 			},
diff --git a/pkg/workflow/security_reports_test.go b/pkg/workflow/security_reports_test.go
index 05621cefcd..55559032db 100644
--- a/pkg/workflow/security_reports_test.go
+++ b/pkg/workflow/security_reports_test.go
@@ -23,7 +23,7 @@ func TestCodeScanningAlertsConfig(t *testing.T) {
 					"create-code-scanning-alert": nil,
 				},
 			},
-			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 0}}, // 0 means unlimited
+			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: nil}}, // 0 means unlimited
 		},
 		{
 			name: "code scanning alert with max configuration",
@@ -34,7 +34,7 @@ func TestCodeScanningAlertsConfig(t *testing.T) {
 					},
 				},
 			},
-			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 50}},
+			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("50")}},
 		},
 		{
 			name: "code scanning alert with driver configuration",
@@ -45,7 +45,7 @@ func TestCodeScanningAlertsConfig(t *testing.T) {
 					},
 				},
 			},
-			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 0}, Driver: "Custom Security Scanner"},
+			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: nil}, Driver: "Custom Security Scanner"},
 		},
 		{
 			name: "code scanning alert with max and driver configuration",
@@ -57,7 +57,7 @@ func TestCodeScanningAlertsConfig(t *testing.T) {
 					},
 				},
 			},
-			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 25}, Driver: "Advanced Scanner"},
+			expectedConfig: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("25")}, Driver: "Advanced Scanner"},
 		},
 		{
 			name: "no code scanning alert configuration",
@@ -87,8 +87,9 @@ func TestCodeScanningAlertsConfig(t *testing.T) {
 				return
 			}
 
-			if config.CreateCodeScanningAlerts.Max != tt.expectedConfig.Max {
-				t.Errorf("Expected Max=%d, got Max=%d", tt.expectedConfig.Max, config.CreateCodeScanningAlerts.Max)
+			if (config.CreateCodeScanningAlerts.Max == nil) != (tt.expectedConfig.Max == nil) ||
+				(config.CreateCodeScanningAlerts.Max != nil && *config.CreateCodeScanningAlerts.Max != *tt.expectedConfig.Max) {
+				t.Errorf("Expected Max=%v, got Max=%v", tt.expectedConfig.Max, config.CreateCodeScanningAlerts.Max)
 			}
 
 			if config.CreateCodeScanningAlerts.Driver != tt.expectedConfig.Driver {
@@ -105,7 +106,7 @@ func TestBuildCreateOutputCodeScanningAlertJob(t *testing.T) {
 	// Test valid configuration
 	data := &WorkflowData{
 		SafeOutputs: &SafeOutputsConfig{
-			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 0}},
+			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: nil}},
 		},
 	}
 
@@ -144,7 +145,7 @@ func TestBuildCreateOutputCodeScanningAlertJob(t *testing.T) {
 	// Test with max configuration
 	dataWithMax := &WorkflowData{
 		SafeOutputs: &SafeOutputsConfig{
-			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 25}},
+			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("25")}},
 		},
 	}
 
@@ -182,7 +183,7 @@ func TestBuildCreateOutputCodeScanningAlertJob(t *testing.T) {
 		Name:            "Security Analysis Workflow",
 		FrontmatterName: "Security Analysis Workflow",
 		SafeOutputs: &SafeOutputsConfig{
-			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 0}}, // No driver specified
+			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: nil}}, // No driver specified
 		},
 	}
 
@@ -201,7 +202,7 @@ func TestBuildCreateOutputCodeScanningAlertJob(t *testing.T) {
 		Name:            "Security Analysis",
 		FrontmatterName: "", // No frontmatter name
 		SafeOutputs: &SafeOutputsConfig{
-			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 0}}, // No driver specified
+			CreateCodeScanningAlerts: &CreateCodeScanningAlertsConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: nil}}, // No driver specified
 		},
 	}
 
@@ -235,7 +236,7 @@ func TestParseCodeScanningAlertsConfig(t *testing.T) {
 	tests := []struct {
 		name           string
 		outputMap      map[string]any
-		expectedMax    int
+		expectedMax    *string
 		expectedDriver string
 		expectNil      bool
 	}{
@@ -244,7 +245,7 @@ func TestParseCodeScanningAlertsConfig(t *testing.T) {
 			outputMap: map[string]any{
 				"create-code-scanning-alert": nil,
 			},
-			expectedMax:    0,
+			expectedMax:    nil,
 			expectedDriver: "",
 			expectNil:      false,
 		},
@@ -255,7 +256,7 @@ func TestParseCodeScanningAlertsConfig(t *testing.T) {
 					"max": 100,
 				},
 			},
-			expectedMax:    100,
+			expectedMax:    strPtr("100"),
 			expectedDriver: "",
 			expectNil:      false,
 		},
@@ -266,7 +267,7 @@ func TestParseCodeScanningAlertsConfig(t *testing.T) {
 					"driver": "Test Security Scanner",
 				},
 			},
-			expectedMax:    0,
+			expectedMax:    nil,
 			expectedDriver: "Test Security Scanner",
 			expectNil:      false,
 		},
@@ -278,7 +279,7 @@ func TestParseCodeScanningAlertsConfig(t *testing.T) {
 					"driver": "Combined Scanner",
 				},
 			},
-			expectedMax:    50,
+			expectedMax:    strPtr("50"),
 			expectedDriver: "Combined Scanner",
 			expectNil:      false,
 		},
@@ -287,7 +288,7 @@ func TestParseCodeScanningAlertsConfig(t *testing.T) {
 			outputMap: map[string]any{
 				"other-config": nil,
 			},
-			expectedMax:    0,
+			expectedMax:    nil,
 			expectedDriver: "",
 			expectNil:      true,
 		},
@@ -309,8 +310,9 @@ func TestParseCodeScanningAlertsConfig(t *testing.T) {
 				return
 			}
 
-			if config.Max != tt.expectedMax {
-				t.Errorf("Expected Max=%d, got Max=%d", tt.expectedMax, config.Max)
+			if (config.Max == nil) != (tt.expectedMax == nil) ||
+				(config.Max != nil && *config.Max != *tt.expectedMax) {
+				t.Errorf("Expected Max=%v, got Max=%v", tt.expectedMax, config.Max)
 			}
 
 			if config.Driver != tt.expectedDriver {
diff --git a/pkg/workflow/staged_awinfo_test.go b/pkg/workflow/staged_awinfo_test.go
index 0e6edcbfd8..8f85cde5ba 100644
--- a/pkg/workflow/staged_awinfo_test.go
+++ b/pkg/workflow/staged_awinfo_test.go
@@ -15,7 +15,7 @@ func TestGenerateCreateAwInfoWithStaged(t *testing.T) {
 	workflowData := &WorkflowData{
 		Name: "test-workflow",
 		SafeOutputs: &SafeOutputsConfig{
-			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			Staged:       true, // pointer to true
 		},
 	}
diff --git a/pkg/workflow/staged_test.go b/pkg/workflow/staged_test.go
index 480b0381b1..84add05157 100644
--- a/pkg/workflow/staged_test.go
+++ b/pkg/workflow/staged_test.go
@@ -88,7 +88,7 @@ func TestClaudeEngineWithStagedFlag(t *testing.T) {
 	workflowData := &WorkflowData{
 		Name: "test-workflow",
 		SafeOutputs: &SafeOutputsConfig{
-			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			Staged:       true, // pointer to true
 		},
 	}
@@ -126,7 +126,7 @@ func TestCodexEngineWithStagedFlag(t *testing.T) {
 	workflowData := &WorkflowData{
 		Name: "test-workflow",
 		SafeOutputs: &SafeOutputsConfig{
-			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1}},
+			CreateIssues: &CreateIssuesConfig{BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}},
 			Staged:       true, // pointer to true
 		},
 	}
diff --git a/pkg/workflow/submit_pr_review.go b/pkg/workflow/submit_pr_review.go
index 1754924074..aff3c9850f 100644
--- a/pkg/workflow/submit_pr_review.go
+++ b/pkg/workflow/submit_pr_review.go
@@ -64,7 +64,7 @@ func (c *Compiler) parseSubmitPullRequestReviewConfig(outputMap map[string]any)
 		}
 	} else {
 		// If configData is nil or not a map, set the default max
-		config.Max = 1
+		config.Max = defaultIntStr(1)
 	}
 
 	return config
diff --git a/pkg/workflow/submit_pr_review_footer_test.go b/pkg/workflow/submit_pr_review_footer_test.go
index 69fcd26196..e6bbb23a3b 100644
--- a/pkg/workflow/submit_pr_review_footer_test.go
+++ b/pkg/workflow/submit_pr_review_footer_test.go
@@ -181,11 +181,11 @@ func TestSubmitPRReviewFooterInHandlerConfig(t *testing.T) {
 			Name: "Test",
 			SafeOutputs: &SafeOutputsConfig{
 				SubmitPullRequestReview: &SubmitPullRequestReviewConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					Footer:               &footerValue,
 				},
 				CreatePullRequestReviewComments: &CreatePullRequestReviewCommentsConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 10},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("10")},
 					Side:                 "RIGHT",
 				},
 			},
@@ -229,7 +229,7 @@ func TestSubmitPRReviewFooterInHandlerConfig(t *testing.T) {
 			Name: "Test",
 			SafeOutputs: &SafeOutputsConfig{
 				SubmitPullRequestReview: &SubmitPullRequestReviewConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
 		}
@@ -268,7 +268,7 @@ func TestSubmitPRReviewFooterInHandlerConfig(t *testing.T) {
 			Name: "Test",
 			SafeOutputs: &SafeOutputsConfig{
 				SubmitPullRequestReview: &SubmitPullRequestReviewConfig{
-					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 					Target:               targetValue,
 				},
 			},
diff --git a/pkg/workflow/templatables.go b/pkg/workflow/templatables.go
index d83219772c..f91dad0104 100644
--- a/pkg/workflow/templatables.go
+++ b/pkg/workflow/templatables.go
@@ -14,15 +14,22 @@
 // ("true"/"false") and GitHub Actions expression strings.  Free-form
 // string literals that are not expressions are rejected with an error.
 //
+// preprocessIntFieldAsString must be called before YAML unmarshaling so
+// that a struct field typed as *string can store both literal integers
+// and GitHub Actions expression strings.  Free-form string literals that
+// are not expressions are rejected with an error.
+//
 // # JS side
 //
-// parseBoolTemplatable (in templatable.cjs) is the counterpart used by
-// safe-output handlers when reading the JSON config at runtime.
+// parseBoolTemplatable and parseIntTemplatable (in templatable.cjs) are
+// the counterparts used by safe-output handlers when reading the JSON
+// config at runtime.
 
 package workflow
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
 
 	"github.com/github/gh-aw/pkg/logger"
@@ -100,3 +107,109 @@ func (b *handlerConfigBuilder) AddTemplatableBool(key string, value *string) *ha
 	}
 	return b
 }
+
+// preprocessIntFieldAsString converts the value of an integer config field
+// to a string before YAML unmarshaling.  This lets struct fields typed as
+// *string accept both literal integer values and GitHub Actions expression
+// strings (e.g. "${{ inputs.max-issues }}").
+//
+// If the value is an int, int64, float64, or uint64 it is converted to its
+// decimal string representation.
+// If the value is a string it must be a GitHub Actions expression (starts
+// with "${{" and ends with "}}"); any other free-form string is rejected
+// and an error is returned.
+func preprocessIntFieldAsString(configData map[string]any, fieldName string, log *logger.Logger) error {
+	if configData == nil {
+		return nil
+	}
+	if val, exists := configData[fieldName]; exists {
+		switch v := val.(type) {
+		case int:
+			configData[fieldName] = strconv.Itoa(v)
+			if log != nil {
+				log.Printf("Converted %s int to string before unmarshaling", fieldName)
+			}
+		case int64:
+			configData[fieldName] = strconv.FormatInt(v, 10)
+			if log != nil {
+				log.Printf("Converted %s int64 to string before unmarshaling", fieldName)
+			}
+		case float64:
+			configData[fieldName] = strconv.Itoa(int(v))
+			if log != nil {
+				log.Printf("Converted %s float64 to string before unmarshaling", fieldName)
+			}
+		case uint64:
+			configData[fieldName] = strconv.FormatUint(v, 10)
+			if log != nil {
+				log.Printf("Converted %s uint64 to string before unmarshaling", fieldName)
+			}
+		case string:
+			if !strings.HasPrefix(v, "${{") || !strings.HasSuffix(v, "}}") {
+				return fmt.Errorf("field %q must be an integer or a GitHub Actions expression (e.g. '${{ inputs.max }}'), got string %q", fieldName, v)
+			}
+			// expression string is already in the correct form
+		}
+	}
+	return nil
+}
+
+// buildTemplatableIntEnvVar returns a YAML environment variable entry for a
+// templatable integer field. If value is a GitHub Actions expression it is
+// embedded unquoted so that GitHub Actions can evaluate it at runtime;
+// otherwise the literal string is quoted. Returns nil if value is nil.
+func buildTemplatableIntEnvVar(envVarName string, value *string) []string {
+	if value == nil {
+		return nil
+	}
+	v := *value
+	if strings.HasPrefix(v, "${{") {
+		return []string{fmt.Sprintf("          %s: %s\n", envVarName, v)}
+	}
+	return []string{fmt.Sprintf("          %s: %q\n", envVarName, v)}
+}
+
+// AddTemplatableInt adds a templatable integer field to the handler config.
+//
+// The stored JSON value depends on the content of *value:
+//   - a numeric string (e.g. "5") → JSON number (backward-compatible with existing handlers)
+//   - any other string (GitHub Actions expression) → stored as a JSON string so
+//     that GitHub Actions can evaluate it at runtime when the env var that
+//     contains the JSON config is expanded
+//   - nil → field is omitted
+func (b *handlerConfigBuilder) AddTemplatableInt(key string, value *string) *handlerConfigBuilder {
+	if value == nil {
+		return b
+	}
+	v := *value
+	// If it parses as an integer, store as JSON number for backward compatibility
+	if n, err := strconv.Atoi(v); err == nil {
+		if n > 0 {
+			b.config[key] = n
+		}
+		return b
+	}
+	// Otherwise it's a GitHub Actions expression – store as string
+	b.config[key] = v
+	return b
+}
+
+// defaultIntStr returns a pointer to the string representation of n.
+// Used to set default values for templatable integer fields when the field is nil.
+func defaultIntStr(n int) *string {
+	s := strconv.Itoa(n)
+	return &s
+}
+
+// templatableIntValue parses a *string templatable integer value to int.
+// Returns 0 if value is nil or is a GitHub Actions expression (not evaluable at compile time).
+// Returns the parsed integer for literal numeric strings.
+func templatableIntValue(value *string) int {
+	if value == nil {
+		return 0
+	}
+	if n, err := strconv.Atoi(*value); err == nil {
+		return n
+	}
+	return 0 // expression strings are not evaluable at compile time
+}
diff --git a/pkg/workflow/test_helpers_shared_test.go b/pkg/workflow/test_helpers_shared_test.go
index 229888d69c..51e8f3eb0c 100644
--- a/pkg/workflow/test_helpers_shared_test.go
+++ b/pkg/workflow/test_helpers_shared_test.go
@@ -6,6 +6,12 @@ func boolPtr(b bool) *bool {
 	return &b
 }
 
+// strPtr returns a pointer to a string value.
+// This is a shared helper used by tests to create *string values for templatable fields.
+func strPtr(s string) *string {
+	return &s
+}
+
 // mockValidationError helps create validation errors for testing.
 // This is a shared helper used by both unit and integration tests.
 type mockValidationError struct {
diff --git a/pkg/workflow/tool_description_enhancer.go b/pkg/workflow/tool_description_enhancer.go
index 32fffb360f..e1e951127f 100644
--- a/pkg/workflow/tool_description_enhancer.go
+++ b/pkg/workflow/tool_description_enhancer.go
@@ -23,9 +23,9 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 	switch toolName {
 	case "create_issue":
 		if config := safeOutputs.CreateIssues; config != nil {
-			toolDescriptionEnhancerLog.Printf("Found create_issue config: max=%d, titlePrefix=%s", config.Max, config.TitlePrefix)
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be created.", config.Max))
+			toolDescriptionEnhancerLog.Printf("Found create_issue config: max=%v, titlePrefix=%s", config.Max, config.TitlePrefix)
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be created.", templatableIntValue(config.Max)))
 			}
 			if config.TitlePrefix != "" {
 				constraints = append(constraints, fmt.Sprintf("Title will be prefixed with %q.", config.TitlePrefix))
@@ -46,8 +46,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "create_agent_session":
 		if config := safeOutputs.CreateAgentSessions; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d agent task(s) can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d agent task(s) can be created.", templatableIntValue(config.Max)))
 			}
 			if config.Base != "" {
 				constraints = append(constraints, fmt.Sprintf("Base branch for tasks: %q.", config.Base))
@@ -62,8 +62,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "create_discussion":
 		if config := safeOutputs.CreateDiscussions; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d discussion(s) can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d discussion(s) can be created.", templatableIntValue(config.Max)))
 			}
 			if config.TitlePrefix != "" {
 				constraints = append(constraints, fmt.Sprintf("Title will be prefixed with %q.", config.TitlePrefix))
@@ -81,8 +81,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "close_discussion":
 		if config := safeOutputs.CloseDiscussions; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d discussion(s) can be closed.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d discussion(s) can be closed.", templatableIntValue(config.Max)))
 			}
 			if config.Target != "" {
 				constraints = append(constraints, fmt.Sprintf("Target: %s.", config.Target))
@@ -91,8 +91,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "close_issue":
 		if config := safeOutputs.CloseIssues; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be closed.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be closed.", templatableIntValue(config.Max)))
 			}
 			if config.Target != "" {
 				constraints = append(constraints, fmt.Sprintf("Target: %s.", config.Target))
@@ -101,8 +101,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "close_pull_request":
 		if config := safeOutputs.ClosePullRequests; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d pull request(s) can be closed.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d pull request(s) can be closed.", templatableIntValue(config.Max)))
 			}
 			if config.Target != "" {
 				constraints = append(constraints, fmt.Sprintf("Target: %s.", config.Target))
@@ -117,8 +117,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "add_comment":
 		if config := safeOutputs.AddComments; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d comment(s) can be added.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d comment(s) can be added.", templatableIntValue(config.Max)))
 			}
 			if config.Target != "" {
 				constraints = append(constraints, fmt.Sprintf("Target: %s.", config.Target))
@@ -130,9 +130,9 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "create_pull_request":
 		if config := safeOutputs.CreatePullRequests; config != nil {
-			toolDescriptionEnhancerLog.Printf("Found create_pull_request config: max=%d, titlePrefix=%s, draft=%v", config.Max, config.TitlePrefix, config.Draft)
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d pull request(s) can be created.", config.Max))
+			toolDescriptionEnhancerLog.Printf("Found create_pull_request config: max=%v, titlePrefix=%s, draft=%v", config.Max, config.TitlePrefix, config.Draft)
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d pull request(s) can be created.", templatableIntValue(config.Max)))
 			}
 			if config.TitlePrefix != "" {
 				constraints = append(constraints, fmt.Sprintf("Title will be prefixed with %q.", config.TitlePrefix))
@@ -153,8 +153,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "create_pull_request_review_comment":
 		if config := safeOutputs.CreatePullRequestReviewComments; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d review comment(s) can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d review comment(s) can be created.", templatableIntValue(config.Max)))
 			}
 			if config.Side != "" {
 				constraints = append(constraints, fmt.Sprintf("Comments will be on the %s side of the diff.", config.Side))
@@ -163,36 +163,36 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "submit_pull_request_review":
 		if config := safeOutputs.SubmitPullRequestReview; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d review(s) can be submitted.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d review(s) can be submitted.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "reply_to_pull_request_review_comment":
 		if config := safeOutputs.ReplyToPullRequestReviewComment; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d reply/replies can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d reply/replies can be created.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "resolve_pull_request_review_thread":
 		if config := safeOutputs.ResolvePullRequestReviewThread; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d review thread(s) can be resolved.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d review thread(s) can be resolved.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "create_code_scanning_alert":
 		if config := safeOutputs.CreateCodeScanningAlerts; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d alert(s) can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d alert(s) can be created.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "add_labels":
 		if config := safeOutputs.AddLabels; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d label(s) can be added.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d label(s) can be added.", templatableIntValue(config.Max)))
 			}
 			if len(config.Allowed) > 0 {
 				constraints = append(constraints, fmt.Sprintf("Only these labels are allowed: %v.", config.Allowed))
@@ -204,8 +204,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "remove_labels":
 		if config := safeOutputs.RemoveLabels; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d label(s) can be removed.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d label(s) can be removed.", templatableIntValue(config.Max)))
 			}
 			if len(config.Allowed) > 0 {
 				constraints = append(constraints, fmt.Sprintf("Only these labels can be removed: %v.", config.Allowed))
@@ -217,15 +217,15 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "add_reviewer":
 		if config := safeOutputs.AddReviewer; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d reviewer(s) can be added.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d reviewer(s) can be added.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "update_issue":
 		if config := safeOutputs.UpdateIssues; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be updated.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be updated.", templatableIntValue(config.Max)))
 			}
 			if config.Target != "" {
 				constraints = append(constraints, fmt.Sprintf("Target: %s.", config.Target))
@@ -243,8 +243,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "update_pull_request":
 		if config := safeOutputs.UpdatePullRequests; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d pull request(s) can be updated.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d pull request(s) can be updated.", templatableIntValue(config.Max)))
 			}
 			if config.Target != "" {
 				constraints = append(constraints, fmt.Sprintf("Target: %s.", config.Target))
@@ -253,16 +253,16 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "push_to_pull_request_branch":
 		if config := safeOutputs.PushToPullRequestBranch; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d push(es) can be made.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d push(es) can be made.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "upload_asset":
 		if config := safeOutputs.UploadAssets; config != nil {
 			toolDescriptionEnhancerLog.Printf("Found upload_asset config: max=%d, maxSizeKB=%d, allowedExts=%v", config.Max, config.MaxSizeKB, config.AllowedExts)
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d asset(s) can be uploaded.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d asset(s) can be uploaded.", templatableIntValue(config.Max)))
 			}
 			if config.MaxSizeKB > 0 {
 				constraints = append(constraints, fmt.Sprintf("Maximum file size: %dKB.", config.MaxSizeKB))
@@ -274,36 +274,36 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "update_release":
 		if config := safeOutputs.UpdateRelease; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d release(s) can be updated.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d release(s) can be updated.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "missing_tool":
 		if config := safeOutputs.MissingTool; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d missing tool report(s) can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d missing tool report(s) can be created.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "link_sub_issue":
 		if config := safeOutputs.LinkSubIssue; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d sub-issue link(s) can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d sub-issue link(s) can be created.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "assign_milestone":
 		if config := safeOutputs.AssignMilestone; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d milestone assignment(s) can be made.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d milestone assignment(s) can be made.", templatableIntValue(config.Max)))
 			}
 		}
 
 	case "assign_to_agent":
 		if config := safeOutputs.AssignToAgent; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be assigned to agent.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d issue(s) can be assigned to agent.", templatableIntValue(config.Max)))
 			}
 			if config.BaseBranch != "" {
 				constraints = append(constraints, fmt.Sprintf("Pull requests will target the %q branch.", config.BaseBranch))
@@ -318,8 +318,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "update_project":
 		if config := safeOutputs.UpdateProjects; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d project operation(s) can be performed.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d project operation(s) can be performed.", templatableIntValue(config.Max)))
 			}
 			if config.Project != "" {
 				constraints = append(constraints, fmt.Sprintf("Default project URL: %q.", config.Project))
@@ -328,8 +328,8 @@ func enhanceToolDescription(toolName, baseDescription string, safeOutputs *SafeO
 
 	case "create_project_status_update":
 		if config := safeOutputs.CreateProjectStatusUpdates; config != nil {
-			if config.Max > 0 {
-				constraints = append(constraints, fmt.Sprintf("Maximum %d status update(s) can be created.", config.Max))
+			if templatableIntValue(config.Max) > 0 {
+				constraints = append(constraints, fmt.Sprintf("Maximum %d status update(s) can be created.", templatableIntValue(config.Max)))
 			}
 			if config.Project != "" {
 				constraints = append(constraints, fmt.Sprintf("Default project URL: %q.", config.Project))
diff --git a/pkg/workflow/unassign_from_user.go b/pkg/workflow/unassign_from_user.go
index 413b18268c..25d53d3403 100644
--- a/pkg/workflow/unassign_from_user.go
+++ b/pkg/workflow/unassign_from_user.go
@@ -30,13 +30,13 @@ func (c *Compiler) parseUnassignFromUserConfig(outputMap map[string]any) *Unassi
 		// For backward compatibility, use defaults
 		unassignFromUserLog.Print("Using default configuration")
 		config = UnassignFromUserConfig{
-			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: 1},
+			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: defaultIntStr(1)},
 		}
 	}
 
 	// Set default max if not specified
-	if config.Max == 0 {
-		config.Max = 1
+	if config.Max == nil {
+		config.Max = defaultIntStr(1)
 	}
 
 	unassignFromUserLog.Printf("Parsed configuration: allowed_count=%d, target=%s", len(config.Allowed), config.Target)
diff --git a/pkg/workflow/update_discussion_test.go b/pkg/workflow/update_discussion_test.go
index 11b5878dd4..123808bbf4 100644
--- a/pkg/workflow/update_discussion_test.go
+++ b/pkg/workflow/update_discussion_test.go
@@ -56,7 +56,7 @@ This workflow tests the update-discussion configuration parsing.
 	}
 
 	// Check defaults
-	if workflowData.SafeOutputs.UpdateDiscussions.Max != 1 {
+	if templatableIntValue(workflowData.SafeOutputs.UpdateDiscussions.Max) != 1 {
 		t.Fatalf("Expected max to be 1, got %d", workflowData.SafeOutputs.UpdateDiscussions.Max)
 	}
 
@@ -133,7 +133,7 @@ This workflow tests the update-discussion configuration with all options.
 	}
 
 	// Check all options
-	if workflowData.SafeOutputs.UpdateDiscussions.Max != 3 {
+	if templatableIntValue(workflowData.SafeOutputs.UpdateDiscussions.Max) != 3 {
 		t.Fatalf("Expected max to be 3, got %d", workflowData.SafeOutputs.UpdateDiscussions.Max)
 	}
 
diff --git a/pkg/workflow/update_entity_helpers.go b/pkg/workflow/update_entity_helpers.go
index 1db316d23a..ece4084942 100644
--- a/pkg/workflow/update_entity_helpers.go
+++ b/pkg/workflow/update_entity_helpers.go
@@ -143,7 +143,7 @@ func (c *Compiler) parseUpdateEntityConfig(outputMap map[string]any, params Upda
 			c.parseBaseSafeOutputConfig(configMap, &config.BaseSafeOutputConfig, 1)
 		} else {
 			// If configData is nil or not a map, still set the default max
-			config.Max = 1
+			config.Max = defaultIntStr(1)
 		}
 
 		return config
diff --git a/pkg/workflow/update_entity_helpers_test.go b/pkg/workflow/update_entity_helpers_test.go
index 9f793f7216..bac955d3ae 100644
--- a/pkg/workflow/update_entity_helpers_test.go
+++ b/pkg/workflow/update_entity_helpers_test.go
@@ -166,7 +166,7 @@ func TestParseUpdateEntityConfigWithFields(t *testing.T) {
 			},
 			wantNil: false,
 			validateFunc: func(t *testing.T, cfg *UpdateEntityConfig) {
-				if cfg.Max != 2 {
+				if templatableIntValue(cfg.Max) != 2 {
 					t.Errorf("Expected max=2, got %d", cfg.Max)
 				}
 			},
@@ -194,7 +194,7 @@ func TestParseUpdateEntityConfigWithFields(t *testing.T) {
 			}(),
 			wantNil: false,
 			validateFunc: func(t *testing.T, cfg *UpdateEntityConfig) {
-				if cfg.Max != 3 {
+				if templatableIntValue(cfg.Max) != 3 {
 					t.Errorf("Expected max=3, got %d", cfg.Max)
 				}
 			},
@@ -219,7 +219,7 @@ func TestParseUpdateEntityConfigWithFields(t *testing.T) {
 			},
 			wantNil: false,
 			validateFunc: func(t *testing.T, cfg *UpdateEntityConfig) {
-				if cfg.Max != 1 {
+				if templatableIntValue(cfg.Max) != 1 {
 					t.Errorf("Expected max=1, got %d", cfg.Max)
 				}
 			},
@@ -283,7 +283,7 @@ func TestParseUpdateEntityConfigTyped(t *testing.T) {
 			configKey:  "update-issue",
 			wantNil:    false,
 			validateFunc: func(t *testing.T, cfg *UpdateIssuesConfig) {
-				if cfg.Max != 2 {
+				if templatableIntValue(cfg.Max) != 2 {
 					t.Errorf("Expected max=2, got %d", cfg.Max)
 				}
 				if cfg.Title == nil {
diff --git a/pkg/workflow/update_issue_test.go b/pkg/workflow/update_issue_test.go
index 3293c83b0b..c01f3832e5 100644
--- a/pkg/workflow/update_issue_test.go
+++ b/pkg/workflow/update_issue_test.go
@@ -59,7 +59,7 @@ This workflow tests the update-issue configuration parsing.
 	}
 
 	// Check defaults
-	if workflowData.SafeOutputs.UpdateIssues.Max != 1 {
+	if templatableIntValue(workflowData.SafeOutputs.UpdateIssues.Max) != 1 {
 		t.Fatalf("Expected max to be 1, got %d", workflowData.SafeOutputs.UpdateIssues.Max)
 	}
 
@@ -134,7 +134,7 @@ This workflow tests the update-issue configuration with all options.
 	}
 
 	// Check all options
-	if workflowData.SafeOutputs.UpdateIssues.Max != 3 {
+	if templatableIntValue(workflowData.SafeOutputs.UpdateIssues.Max) != 3 {
 		t.Fatalf("Expected max to be 3, got %d", workflowData.SafeOutputs.UpdateIssues.Max)
 	}
 
diff --git a/pkg/workflow/update_project.go b/pkg/workflow/update_project.go
index 06c088c6a5..541edef7ba 100644
--- a/pkg/workflow/update_project.go
+++ b/pkg/workflow/update_project.go
@@ -35,7 +35,7 @@ func (c *Compiler) parseUpdateProjectConfig(outputMap map[string]any) *UpdatePro
 	if configData, exists := outputMap["update-project"]; exists {
 		updateProjectLog.Print("Parsing update-project configuration")
 		updateProjectConfig := &UpdateProjectConfig{}
-		updateProjectConfig.Max = 10 // Default max is 10
+		updateProjectConfig.Max = defaultIntStr(10) // Default max is 10
 
 		if configMap, ok := configData.(map[string]any); ok {
 			// Parse base config (max, github-token)