diff --git a/tmpl/kubernetes/github-webhook-token-secret.sops.yaml b/tmpl/kubernetes/github-webhook-token-secret.sops.yaml
index ab22b6dc..58b3f916 100644
--- a/tmpl/kubernetes/github-webhook-token-secret.sops.yaml
+++ b/tmpl/kubernetes/github-webhook-token-secret.sops.yaml
@@ -5,4 +5,4 @@ metadata:
   name: github-webhook-token-secret
   namespace: flux-system
 stringData:
-  token: ${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}
+  token: "${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}"