diff --git a/install/0000_00_cluster-version-operator_03_deployment.yaml b/install/0000_00_cluster-version-operator_03_deployment.yaml
index 734fae925..edb4252c8 100644
--- a/install/0000_00_cluster-version-operator_03_deployment.yaml
+++ b/install/0000_00_cluster-version-operator_03_deployment.yaml
@@ -25,7 +25,7 @@ spec:
       automountServiceAccountToken: false
       containers:
       - name: cluster-version-operator
-        image: {{.ReleaseImage}}
+        image: '{{.ReleaseImage}}'
         imagePullPolicy: IfNotPresent
         args:
         - "start"
@@ -70,7 +70,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: CLUSTER_PROFILE
-          value: {{ .ClusterProfile }}
+          value: '{{ .ClusterProfile }}'
       # this pod is hostNetwork and uses the internal LB DNS name when possible, which the kubelet also uses.
       # this dnsPolicy allows us to use the same dnsConfig as the kubelet, without access to read it ourselves.
       dnsPolicy: Default
diff --git a/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml b/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml
index 8d29a1c3d..857669c3e 100644
--- a/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml
+++ b/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml
@@ -25,7 +25,7 @@ spec:
       automountServiceAccountToken: false
       containers:
       - name: cluster-version-operator
-        image: quay.io/cvo/release:latest
+        image: 'quay.io/cvo/release:latest'
         imagePullPolicy: IfNotPresent
         args:
         - "start"
@@ -70,7 +70,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: CLUSTER_PROFILE
-          value: some-profile
+          value: 'some-profile'
       # this pod is hostNetwork and uses the internal LB DNS name when possible, which the kubelet also uses.
       # this dnsPolicy allows us to use the same dnsConfig as the kubelet, without access to read it ourselves.
       dnsPolicy: Default