diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e8c1aa8b..a9ac90f2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -416,7 +416,7 @@ jobs:
           gh release download ${tag} --repo ${GITHUB_REPOSITORY}
           shasum -a 256 -c SHA256SUMS
           for file in mendcode-*.zip mendcode-*.tar.gz SHA256SUMS RELEASE-MANIFEST.txt mendcode.spdx.json; do
-            gh attestation verify --repo ${GITHUB_REPOSITORY} "$file"
+            gh attestation verify --repo ${GITHUB_REPOSITORY} "\$file"
           done
           \`\`\`
           EOF