diff --git a/.github/publish-maven.sh b/.github/publish-maven.sh
index e9edc8660..bb938174b 100755
--- a/.github/publish-maven.sh
+++ b/.github/publish-maven.sh
@@ -56,7 +56,7 @@ cat <<EOF >~/.m2/settings.xml
         <activeByDefault>true</activeByDefault>
       </activation>
       <properties>
-        <gpg.passphrase>${PGP_PASSPHRASE}</gpg.passphrase>
+        <gpg.passphrase><![CDATA[${PGP_PASSPHRASE}]]></gpg.passphrase>
       </properties>
     </profile>
   </profiles>
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b584e677f..99af1e008 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -57,7 +57,7 @@ jobs:
           export SDK_VERSION="$(cat ~/akka-javasdk-version.txt)"
           ./.github/publish-maven.sh
         env:
-          PGP_PASSPHRASE: '${{ secrets.PGP_PASSPHRASE }}'
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
           PGP_SECRET: ${{ secrets.PGP_SECRET }}
           SONATYPE_USERNAME: ${{ secrets.SONATYPE_AKKA_IO_USERNAME }}
           SONATYPE_PASSWORD: ${{ secrets.SONATYPE_AKKA_IO_PASSWORD }}