diff --git a/.github/scripts/check-lfs-pointers.sh b/.github/scripts/check-lfs-pointers.sh
new file mode 100755
index 0000000..3b88880
--- /dev/null
+++ b/.github/scripts/check-lfs-pointers.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Verifies that every LFS-tracked path is committed as a Git LFS pointer rather than as a raw binary.
+#
+# Requires a checkout performed without LFS smudging: a raw-committed binary is only distinguishable from a proper pointer at the object level, not in a smudged working tree.
+
+set -eu
+
+# Every tracked path whose .gitattributes filter resolves to lfs must be committed as an LFS pointer. A binary committed in its place (e.g. by a contributor without git-lfs installed) is the failure this guard catches.
+should_be_lfs=$(git ls-files | git check-attr --stdin filter | sed -n 's/: filter: lfs$//p')
+
+violations=""
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  first_line=$(git cat-file -p "HEAD:$f" | head -n1)
+  if [ "$first_line" != "version https://git-lfs.github.com/spec/v1" ]; then
+    violations="$violations $f"
+  fi
+done <<< "$should_be_lfs"
+
+if [ -n "$violations" ]; then
+  echo "::error::Files match an LFS pattern in .gitattributes but were committed as raw blobs instead of Git LFS pointers:"
+  # Unquoted expansion is intentional: the accumulated list is split on whitespace back into individual paths.
+  for f in $violations; do echo "  - $f"; done
+  echo "Fix: install git-lfs, run 'git lfs install', then 're-add' each file with 'git add --renormalize <file>' and recommit."
+  exit 1
+fi
+
+echo "All LFS-tracked files are stored as pointers."
diff --git a/.github/scripts/run-selene.sh b/.github/scripts/run-selene.sh
new file mode 100755
index 0000000..5972e74
--- /dev/null
+++ b/.github/scripts/run-selene.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Downloads a pinned selene release and lints the repository's Lua sources.
+#
+# selene publishes no maintained GitHub Action, so the linter binary is fetched per run. The version is pinned so that an upstream release cannot change CI results without a deliberate commit here.
+
+set -euo pipefail
+
+SELENE_VERSION="0.30.1"
+SELENE_URL="https://github.com/Kampfkarren/selene/releases/download/${SELENE_VERSION}/selene-light-${SELENE_VERSION}-linux.zip"
+
+curl -sL "$SELENE_URL" -o selene.zip
+unzip -q selene.zip
+chmod +x selene
+./selene assets/scripts/ mods/
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6dbd113..97800c9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,11 +46,7 @@ jobs:
           args: --check assets/scripts/ mods/
 
       - name: Run Selene
-        run: |
-          curl -sL https://github.com/Kampfkarren/selene/releases/download/0.30.1/selene-light-0.30.1-linux.zip -o selene.zip
-          unzip -q selene.zip
-          chmod +x selene
-          ./selene assets/scripts/ mods/
+        run: ./.github/scripts/run-selene.sh
 
   lfs-guard:
     name: LFS Pointer Guard
@@ -62,21 +58,4 @@ jobs:
           lfs: false
 
       - name: Verify LFS-tracked files are stored as pointers
-        run: |
-          # Every tracked path whose .gitattributes filter resolves to lfs must be committed as an LFS pointer. A binary committed in its place (e.g. by a contributor without git-lfs installed) is the failure this guard catches.
-          should_be_lfs=$(git ls-files | git check-attr --stdin filter | sed -n 's/: filter: lfs$//p')
-          violations=""
-          while IFS= read -r f; do
-            [ -z "$f" ] && continue
-            first_line=$(git cat-file -p "HEAD:$f" | head -n1)
-            if [ "$first_line" != "version https://git-lfs.github.com/spec/v1" ]; then
-              violations="$violations $f"
-            fi
-          done <<< "$should_be_lfs"
-          if [ -n "$violations" ]; then
-            echo "::error::Files match an LFS pattern in .gitattributes but were committed as raw blobs instead of Git LFS pointers:"
-            for f in $violations; do echo "  - $f"; done
-            echo "Fix: install git-lfs, run 'git lfs install', then 're-add' each file with 'git add --renormalize <file>' and recommit."
-            exit 1
-          fi
-          echo "All LFS-tracked files are stored as pointers."
+        run: ./.github/scripts/check-lfs-pointers.sh