diff --git a/ansible/vars/metacluster.yml b/ansible/vars/metacluster.yml
index e605c81..4228e73 100644
--- a/ansible/vars/metacluster.yml
+++ b/ansible/vars/metacluster.yml
@@ -111,16 +111,16 @@ components:
               inCluster: true
           staticClients:
           - id: pinniped-supervisor
-            secret: {{ lookup('ansible.builtin.password', '/dev/null length=64 chars=ascii_lowercase,digits seed=' ~ vapp['metacluster.fqdn']) }}
+            secret: "{{ lookup('ansible.builtin.password', '/dev/null length=64 chars=ascii_lowercase,digits seed=' ~ vapp['metacluster.fqdn']) }}"
             name: Pinniped Supervisor client
             redirectURIs:
             - https://auth.{{ vapp['metacluster.fqdn'] }}/callback
           enablePasswordDB: true
           staticPasswords:
           - email: admin@{{ vapp['metacluster.fqdn'] }}
-            hash: {{ vapp['metacluster.password'] | password_hash('bcrypt') }}
+            hash: "{{ vapp['metacluster.password'] | password_hash('bcrypt') }}"
             username: admin
-            userID: {{ lookup('ansible.builtin.password', '/dev/null length=64 chars=ascii_lowercase,digits seed=' ~ vapp['metacluster.fqdn']) | to_uuid }}
+            userID: "{{ lookup('ansible.builtin.password', '/dev/null length=64 chars=ascii_lowercase,digits seed=' ~ vapp['metacluster.fqdn']) | to_uuid }}"
         ingress:
           enabled: true
           hosts: