diff --git a/nix/modules/drone.nix b/nix/modules/drone.nix
index aad5b2e..08d6818 100644
--- a/nix/modules/drone.nix
+++ b/nix/modules/drone.nix
@@ -55,7 +55,7 @@ let
       # Stack-scoped: secret names are prefixed with the app's stack name, so during the
       # 2026-09 domain rename the OLD stack's *_rpc_secret_v1 must not satisfy this check.
       DRONE_STACK="drone_ci_autonomic_zone"
-      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "^${DRONE_STACK}_$1_v1$"; }
+      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "^''${DRONE_STACK}_$1_v1$"; }
       have_secret rpc_secret    || abra app secret insert "$DRONE_DOMAIN" rpc_secret    v1 /run/secrets/drone_rpc_secret          -f -n
       have_secret client_secret || abra app secret insert "$DRONE_DOMAIN" client_secret v1 /run/secrets/drone_gitea_client_secret -f -n