diff --git a/.github/workflows/testkube.yml b/.github/workflows/testkube.yml
index 01790c3..53c9351 100644
--- a/.github/workflows/testkube.yml
+++ b/.github/workflows/testkube.yml
@@ -86,12 +86,9 @@ jobs:
           kubectl exec -it --namespace=db svc/postgres  -- /bin/sh -c "swoop-db up"
           kubectl exec -it --namespace=db svc/postgres  -- /bin/sh -c "swoop-db load-fixture base_01"
 
+      - uses: kubeshop/setup-testkube@v1
       - name: Installing Testkube
         run: |
-          wget -qO - https://repo.testkube.io/key.pub | sudo apt-key add -
-          echo "deb https://repo.testkube.io/linux linux main" | sudo tee -a /etc/apt/sources.list
-          sudo apt-get update
-          sudo apt-get install -y testkube
           kubectl testkube install --no-confirm
           kubectl wait --for=condition=ready --timeout=30m pod -n testkube -l app.kubernetes.io/instance=testkube
           kubectl port-forward -n testkube svc/testkube-api-server 8088:8088 &
diff --git a/modules/swoop/swoop-bundle/main.tf b/modules/swoop/swoop-bundle/main.tf
index 8827a78..6c8cff1 100644
--- a/modules/swoop/swoop-bundle/main.tf
+++ b/modules/swoop/swoop-bundle/main.tf
@@ -179,7 +179,7 @@ resource "helm_release" "swoop_bundle" {
   }
 
   dynamic "set" {
-    for_each = var.swoop_sa_iam_role != "" ? [var.swoop_sa_iam_role] : []
+    for_each = nonsensitive(var.swoop_sa_iam_role) != "" ? [nonsensitive(var.swoop_sa_iam_role)] : []
     content {
       name  = "swoop-caboose.argo-workflows.workflow.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
       value = set.value
@@ -231,7 +231,7 @@ resource "helm_release" "swoop_bundle" {
   }
 
   dynamic "set" {
-    for_each = var.swoop_sa_iam_role != "" ? [var.swoop_sa_iam_role] : []
+    for_each = nonsensitive(var.swoop_sa_iam_role) != "" ? [nonsensitive(var.swoop_sa_iam_role)] : []
     content {
       name  = "swoop-conductor.argo-workflows.workflow.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
       value = set.value