diff --git a/.github/workflows/validate-cdxa.yml b/.github/workflows/validate-cdxa.yml
index 5198809..f81ff87 100644
--- a/.github/workflows/validate-cdxa.yml
+++ b/.github/workflows/validate-cdxa.yml
@@ -43,7 +43,7 @@ jobs:
         run: |
           ls -l
           XML_FILES=$(gh pr view "$PR_NUMBER" --repo "$REPOSITORY" --json files | jq -r '.files[] | .path')
-          for XML_FILE in "$XML_FILES"; do
+          echo "$XML_FILES" | while read XML_FILE; do
               echo "CycloneDX validating file: $XML_FILE"
               ./cyclonedx-linux-x64 validate --input-file "$XML_FILE" --fail-on-errors --input-version v1_6
           done