diff --git a/.github/workflows/apply.yaml b/.github/workflows/apply.yaml
index a5be3c4..351c41a 100644
--- a/.github/workflows/apply.yaml
+++ b/.github/workflows/apply.yaml
@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@8b5e8b768746b50394015010d25e690bfab9dfbc # v3.6.0
       - name: Unlock git-crypt secrets
         run: |
-          base64 -d > git-crypt-key <<< {{ secrets.GIT_CRYPT_KEY_BASE64 }}
+          base64 -d > git-crypt-key <<< "${{ secrets.GIT_CRYPT_KEY_BASE64 }}"
           git-crypt unlock git-crypt-key
           rm git-crypt-key
       - name: Run Ansible playbook