diff --git a/hack/build.sh b/hack/build.sh
index 49183175a..3bb96a5ca 100755
--- a/hack/build.sh
+++ b/hack/build.sh
@@ -5,6 +5,7 @@ set -eux
 
 IS_CONTAINER="${IS_CONTAINER:-false}"
 CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
+WORKDIR="${WORKDIR:-/workdir}"
 
 if [ "${IS_CONTAINER}" != "false" ]; then
     export XDG_CACHE_HOME=/tmp/.cache
@@ -15,9 +16,9 @@ if [ "${IS_CONTAINER}" != "false" ]; then
 else
     "${CONTAINER_RUNTIME}" run --rm \
         --env IS_CONTAINER=TRUE \
-        --volume "${PWD}:/workdir:ro,z" \
+        --volume "${PWD}:${WORKDIR}:ro,z" \
         --entrypoint sh \
-        --workdir /workdir \
+        --workdir "${WORKDIR}" \
         docker.io/golang:1.22 \
-        /workdir/hack/build.sh "$@"
+        "${WORKDIR}"/hack/build.sh "$@"
 fi
diff --git a/hack/codegen.sh b/hack/codegen.sh
index a85e0413b..a4e93f7c5 100755
--- a/hack/codegen.sh
+++ b/hack/codegen.sh
@@ -9,10 +9,11 @@ set -eux
 IS_CONTAINER="${IS_CONTAINER:-false}"
 ARTIFACTS="${ARTIFACTS:-/tmp}"
 CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
+WORKDIR="${WORKDIR:-/workdir}"
 
 if [ "${IS_CONTAINER}" != "false" ]; then
     # we need to tell git its OK to use dir owned by someone else
-    git config --global safe.directory /workdir
+    git config --global safe.directory "${WORKDIR}"
     export XDG_CACHE_HOME="/tmp/.cache"
 
     INPUT_FILES="$(git ls-files config) $(git ls-files | grep zz_generated)"
@@ -25,9 +26,9 @@ if [ "${IS_CONTAINER}" != "false" ]; then
 else
     "${CONTAINER_RUNTIME}" run --rm \
         --env IS_CONTAINER=TRUE \
-        --volume "${PWD}:/workdir:rw,z" \
+        --volume "${PWD}:${WORKDIR}:rw,z" \
         --entrypoint sh \
-        --workdir /workdir \
+        --workdir "${WORKDIR}" \
         docker.io/golang:1.22 \
-        /workdir/hack/codegen.sh "$@"
+        "${WORKDIR}"/hack/codegen.sh "$@"
 fi
diff --git a/hack/gomod.sh b/hack/gomod.sh
index 92d30869f..270f52387 100755
--- a/hack/gomod.sh
+++ b/hack/gomod.sh
@@ -10,6 +10,7 @@ set -eux
 
 IS_CONTAINER="${IS_CONTAINER:-false}"
 CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
+WORKDIR="${WORKDIR:-/workdir}"
 
 if [ "${IS_CONTAINER}" != "false" ]; then
     export XDG_CACHE_HOME=/tmp/.cache
@@ -37,9 +38,9 @@ if [ "${IS_CONTAINER}" != "false" ]; then
 else
     "${CONTAINER_RUNTIME}" run --rm \
         --env IS_CONTAINER=TRUE \
-        --volume "${PWD}:/workdir:ro,z" \
+        --volume "${PWD}:${WORKDIR}:ro,z" \
         --entrypoint sh \
-        --workdir /workdir \
+        --workdir "${WORKDIR}" \
         docker.io/golang:1.22 \
-        /workdir/hack/gomod.sh "$@"
+        "${WORKDIR}"/hack/gomod.sh "$@"
 fi
diff --git a/hack/manifestlint.sh b/hack/manifestlint.sh
index 12dc08910..72c4d4a06 100755
--- a/hack/manifestlint.sh
+++ b/hack/manifestlint.sh
@@ -6,6 +6,7 @@ set -eux
 IS_CONTAINER="${IS_CONTAINER:-false}"
 CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
 K8S_VERSION="${K8S_VERSION:-master}"
+WORKDIR="${WORKDIR:-/workdir}"
 
 # --strict: Disallow additional properties not in schema.
 # --ignore-missing-schemas: Skip validation for resource
@@ -32,9 +33,9 @@ else
     "${CONTAINER_RUNTIME}" run --rm \
         --env IS_CONTAINER=TRUE \
         --env KUBECONFORM_PATH="/" \
-        --volume "${PWD}:/workdir:ro,z" \
+        --volume "${PWD}:${WORKDIR}:ro,z" \
         --entrypoint sh \
-        --workdir /workdir \
+        --workdir "${WORKDIR}" \
         ghcr.io/yannh/kubeconform:v0.6.2-alpine@sha256:49b5f6b320d30c1b8b72a7abdf02740ac9dc36a3ba23b934d1c02f7b37e6e740 \
-        /workdir/hack/manifestlint.sh "$@"
+        "${WORKDIR}"/hack/manifestlint.sh "$@"
 fi
diff --git a/hack/markdownlint.sh b/hack/markdownlint.sh
index 11b7b0fb5..37101ea19 100755
--- a/hack/markdownlint.sh
+++ b/hack/markdownlint.sh
@@ -6,6 +6,7 @@ set -eux
 
 IS_CONTAINER="${IS_CONTAINER:-false}"
 CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
+WORKDIR="${WORKDIR:-/workdir}"
 
 # all md files, but ignore .github
 if [ "${IS_CONTAINER}" != "false" ]; then
@@ -13,9 +14,9 @@ if [ "${IS_CONTAINER}" != "false" ]; then
 else
     "${CONTAINER_RUNTIME}" run --rm \
         --env IS_CONTAINER=TRUE \
-        --volume "${PWD}:/workdir:ro,z" \
+        --volume "${PWD}:${WORKDIR}:ro,z" \
         --entrypoint sh \
-        --workdir /workdir \
+        --workdir "${WORKDIR}" \
         docker.io/pipelinecomponents/markdownlint-cli2:0.9.0@sha256:71370df6c967bae548b0bfd0ae313ddf44bfad87da76f88180eff55c6264098c \
-        /workdir/hack/markdownlint.sh "$@"
+        "${WORKDIR}"/hack/markdownlint.sh "$@"
 fi
diff --git a/hack/shellcheck.sh b/hack/shellcheck.sh
index 97bd782cf..bfb577a09 100755
--- a/hack/shellcheck.sh
+++ b/hack/shellcheck.sh
@@ -5,16 +5,17 @@ set -eux
 
 IS_CONTAINER="${IS_CONTAINER:-false}"
 CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
+WORKDIR="${WORKDIR:-/workdir}"
 
 if [ "${IS_CONTAINER}" != "false" ]; then
     TOP_DIR="${1:-.}"
-    find "${TOP_DIR}" -path ./vendor -prune -o -name '*.sh' -type f -exec shellcheck -s bash {} \+
+    find "${TOP_DIR}" -name '*.sh' -type f -exec shellcheck -s bash {} \+
 else
     "${CONTAINER_RUNTIME}" run --rm \
         --env IS_CONTAINER=TRUE \
-        --volume "${PWD}:/workdir:ro,z" \
+        --volume "${PWD}:${WORKDIR}:ro,z" \
         --entrypoint sh \
-        --workdir /workdir \
+        --workdir "${WORKDIR}" \
         docker.io/koalaman/shellcheck-alpine:v0.10.0@sha256:5921d946dac740cbeec2fb1c898747b6105e585130cc7f0602eec9a10f7ddb63 \
-        /workdir/hack/shellcheck.sh "$@"
+        "${WORKDIR}"/hack/shellcheck.sh "$@"
 fi
diff --git a/hack/unit.sh b/hack/unit.sh
index 629c71ec8..d01efdf73 100755
--- a/hack/unit.sh
+++ b/hack/unit.sh
@@ -5,6 +5,7 @@ set -eux
 
 IS_CONTAINER="${IS_CONTAINER:-false}"
 CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
+WORKDIR="${WORKDIR:-/workdir}"
 
 if [ "${IS_CONTAINER}" != "false" ]; then
     export XDG_CACHE_HOME=/tmp/.cache
@@ -15,9 +16,9 @@ if [ "${IS_CONTAINER}" != "false" ]; then
 else
     "${CONTAINER_RUNTIME}" run --rm \
         --env IS_CONTAINER=TRUE \
-        --volume "${PWD}:/workdir:ro,z" \
+        --volume "${PWD}:${WORKDIR}:ro,z" \
         --entrypoint sh \
-        --workdir /workdir \
+        --workdir "${WORKDIR}" \
         docker.io/golang:1.22 \
-        /workdir/hack/unit.sh "$@"
+        "${WORKDIR}"/hack/unit.sh "$@"
 fi