diff --git a/github-actions/entrypoint.sh b/github-actions/entrypoint.sh
index bdca6f1..af3801d 100755
--- a/github-actions/entrypoint.sh
+++ b/github-actions/entrypoint.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-eval $(/awscredswrap --role-arn ${INPUT_ROLE_ARN} --role-session-name ${INPUT_ROLE_SESSION_NAME} --duration-seconds ${INPUT_DURATION_SECONDS})
+eval "$(/awscredswrap --role-arn ${INPUT_ROLE_ARN} --role-session-name ${INPUT_ROLE_SESSION_NAME} --duration-seconds ${INPUT_DURATION_SECONDS})"
 
 echo ::add-mask::${AWS_ACCESS_KEY_ID}
 echo ::add-mask::${AWS_SECRET_ACCESS_KEY}