diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 57b0002d..613ac81f 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -25,7 +25,7 @@ jobs:
           git config --local user.email '41898282+github-actions[bot]@users.noreply.github.com'
           git add .
           git commit -m "Run tidy / bazel+gazelle"
-          git push origin HEAD:GITHUB_HEAD_REF
+          git push origin "HEAD:${GITHUB_HEAD_REF}"
           gh pr review --approve "$PR_URL"
           gh pr merge --auto --merge "$PR_URL"
         env: