diff --git a/ansible/vars/workloadcluster.yml b/ansible/vars/workloadcluster.yml
index ca1539a..1d86914 100644
--- a/ansible/vars/workloadcluster.yml
+++ b/ansible/vars/workloadcluster.yml
@@ -28,11 +28,11 @@ downstream:
       chart_values: !unsafe |
         supervisor:
           enabled: false
-      extra_manifests: !unsafe
+      extra_manifests:
         - src: jwtauthenticator.j2
           _template:
             name: metacluster-sso
-            spec: |2
+            spec: !unsafe |2
                 issuer: https://auth.{{ vapp['metacluster.fqdn'] }}/sso
                 audience: {{ vapp['workloadcluster.name'] | lower }}
                 tls: