diff --git a/tmpl/.sops.yaml b/tmpl/.sops.yaml
index ffd9d384..a2f3539e 100644
--- a/tmpl/.sops.yaml
+++ b/tmpl/.sops.yaml
@@ -2,5 +2,5 @@
 creation_rules:
 - encrypted_regex: '^(data|stringData)$'
   pgp: >-
-    $FLUX_KEY_FP,
-    $PERSONAL_KEY_FP
+    ${FLUX_KEY_FP},
+    ${PERSONAL_KEY_FP}
diff --git a/tmpl/cluster-secrets.yaml b/tmpl/cluster-secrets.yaml
index fd587af6..9cad1acc 100644
--- a/tmpl/cluster-secrets.yaml
+++ b/tmpl/cluster-secrets.yaml
@@ -5,6 +5,6 @@ metadata:
     name: cluster-secrets
     namespace: flux-system
 stringData:
-    SECRET_DOMAIN: $BOOTSTRAP_DOMAIN
-    SECRET_DOMAIN_CERT: $BOOTSTRAP_DOMAIN_CERT
-    SECRET_CLOUDFLARE_EMAIL: $BOOTSTRAP_CLOUDFLARE_EMAIL
+    SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN}
+    SECRET_DOMAIN_CERT: ${BOOTSTRAP_DOMAIN_CERT}
+    SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}
diff --git a/tmpl/cluster-settings.yaml b/tmpl/cluster-settings.yaml
index 5e5bb0ae..64f17b2d 100644
--- a/tmpl/cluster-settings.yaml
+++ b/tmpl/cluster-settings.yaml
@@ -5,5 +5,5 @@ metadata:
   name: cluster-settings
   namespace: flux-system
 data:
-  METALLB_LB_RANGE: $BOOTSTRAP_METALLB_LB_RANGE
-  INGRESS_NGINX_LB: $BOOTSTRAP_INGRESS_NGINX_LB
+  METALLB_LB_RANGE: ${BOOTSTRAP_METALLB_LB_RANGE}
+  INGRESS_NGINX_LB: ${BOOTSTRAP_INGRESS_NGINX_LB}
diff --git a/tmpl/gotk-sync.yaml b/tmpl/gotk-sync.yaml
index a50dc5d1..2ca506b0 100644
--- a/tmpl/gotk-sync.yaml
+++ b/tmpl/gotk-sync.yaml
@@ -8,7 +8,7 @@ spec:
   interval: 1m0s
   ref:
     branch: main
-  url: $BOOTSTRAP_GITHUB_REPOSITORY
+  url: ${BOOTSTRAP_GITHUB_REPOSITORY}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization