diff --git a/.github/workflows/deploy-canary-groups.yml b/.github/workflows/deploy-canary-groups.yml
index bbb55c3f87..87c9c0b626 100644
--- a/.github/workflows/deploy-canary-groups.yml
+++ b/.github/workflows/deploy-canary-groups.yml
@@ -60,7 +60,7 @@ jobs:
           git config --global user.email github-actions@github.com
           git add desk/desk.docket-0
           git commit -n -m "update glob: ${{ steps.glob.outputs.hash }} [skip actions]" || echo "No changes to commit"
-          INPUT=${TAG}
+          INPUT="$TAG"
           BRANCH=${INPUT:-"staging"}
           git pull origin $BRANCH --rebase --autostash
           git push
@@ -81,7 +81,7 @@ jobs:
       - id: deploy
         name: Deploy
         run:
-          ./.github/helpers/deploy.sh tloncorp/landscape-apps groups binnec-dozzod-marnus us-central1-a mainnet-tlon-other-2d ${TAG}
+          ./.github/helpers/deploy.sh tloncorp/landscape-apps groups binnec-dozzod-marnus us-central1-a mainnet-tlon-other-2d "$TAG"
         env:
           SSH_SEC_KEY: ${{ secrets.GCP_SSH_SEC_KEY }}
           SSH_PUB_KEY: ${{ secrets.GCP_SSH_PUB_KEY }}