diff --git a/.github/workflows/pathogen-repo-build.yaml b/.github/workflows/pathogen-repo-build.yaml
index afb14cd..e3ed2e7 100644
--- a/.github/workflows/pathogen-repo-build.yaml
+++ b/.github/workflows/pathogen-repo-build.yaml
@@ -274,7 +274,7 @@ jobs:
           export PREFIX="${REPO_NAME}_"
 
           aws_inline_session_policy=$("$NEXTSTRAIN_GITHUB_DIR"/bin/interpolate-env < "$NEXTSTRAIN_GITHUB_DIR"/text-templates/repo-aws-iam-policy.json | jq -c .)
-          echo "AWS_INLINE_SESSION_POLICY=$aws_inline_session_policy" | tee -a $GITHUB_ENV
+          echo "AWS_INLINE_SESSION_POLICY=$aws_inline_session_policy" | tee -a "$GITHUB_ENV"
       - uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-region: us-east-1
diff --git a/.github/workflows/pathogen-repo-build.yaml.in b/.github/workflows/pathogen-repo-build.yaml.in
index b21968d..e1482a3 100644
--- a/.github/workflows/pathogen-repo-build.yaml.in
+++ b/.github/workflows/pathogen-repo-build.yaml.in
@@ -237,7 +237,7 @@ jobs:
           export PREFIX="${REPO_NAME}_"
 
           aws_inline_session_policy=$("$NEXTSTRAIN_GITHUB_DIR"/bin/interpolate-env < "$NEXTSTRAIN_GITHUB_DIR"/text-templates/repo-aws-iam-policy.json | jq -c .)
-          echo "AWS_INLINE_SESSION_POLICY=$aws_inline_session_policy" | tee -a $GITHUB_ENV
+          echo "AWS_INLINE_SESSION_POLICY=$aws_inline_session_policy" | tee -a "$GITHUB_ENV"
 
       - uses: aws-actions/configure-aws-credentials@v4
         with: