diff --git a/.github/workflows/deploy-cloud-run.yml b/.github/workflows/deploy-cloud-run.yml
index 744421e..c34c14f 100644
--- a/.github/workflows/deploy-cloud-run.yml
+++ b/.github/workflows/deploy-cloud-run.yml
@@ -46,9 +46,38 @@ jobs:
       - name: Set up Cloud SDK
         uses: google-github-actions/setup-gcloud@v2
 
+      - name: Validate inputs
+        env:
+          SERVICE_NAME: ${{ inputs.service_name }}
+          REGION: ${{ inputs.region }}
+          PROJECT_ID: ${{ inputs.project_id }}
+          CLOUDBUILD_CONFIG: ${{ inputs.cloudbuild_config }}
+        run: |
+          if ! printf '%s' "$SERVICE_NAME" | grep -Eq '^[a-z0-9-]+$'; then
+            echo "Invalid service_name: must match ^[a-z0-9-]+$" >&2
+            exit 1
+          fi
+          if ! printf '%s' "$REGION" | grep -Eq '^[a-z0-9-]+$'; then
+            echo "Invalid region: must match ^[a-z0-9-]+$" >&2
+            exit 1
+          fi
+          if ! printf '%s' "$PROJECT_ID" | grep -Eq '^[a-z0-9-]+$'; then
+            echo "Invalid project_id: must match ^[a-z0-9-]+$" >&2
+            exit 1
+          fi
+          if ! printf '%s' "$CLOUDBUILD_CONFIG" | grep -Eq '^[A-Za-z0-9._/-]+$' || printf '%s' "$CLOUDBUILD_CONFIG" | grep -q '\.\.'; then
+            echo "Invalid cloudbuild_config: must be a repo-relative path without shell metacharacters" >&2
+            exit 1
+          fi
+
       - name: Submit Cloud Build
+        env:
+          SERVICE_NAME: ${{ inputs.service_name }}
+          REGION: ${{ inputs.region }}
+          PROJECT_ID: ${{ inputs.project_id }}
+          CLOUDBUILD_CONFIG: ${{ inputs.cloudbuild_config }}
         run: |
-          echo "Deploying ${{ inputs.service_name }} to ${{ inputs.region }} in project ${{ inputs.project_id }}"
+          echo "Deploying $SERVICE_NAME to $REGION in project $PROJECT_ID"
           gcloud builds submit \
-            --config=${{ inputs.cloudbuild_config }} \
-            --project=${{ inputs.project_id }}
+            --config="$CLOUDBUILD_CONFIG" \
+            --project="$PROJECT_ID"