diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index 4d97898..82d1d21 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -125,7 +125,12 @@ jobs:
 
       - name: CDK deploy
         working-directory: ${{ inputs.cdk-dir }}
-        run: npx -y cdk deploy ${{ inputs.stacks }} --require-approval never
+        # Env-var indirection (not inline expression interpolation) so shell
+        # metacharacters in the input are never parsed as script; unquoted
+        # $STACKS deliberately word-splits multiple selectors.
+        env:
+          STACKS: ${{ inputs.stacks }}
+        run: npx -y cdk deploy $STACKS --require-approval never
 
       - name: Post-deploy script
         if: ${{ inputs.post-deploy-script != '' }}