diff --git a/gootstrap.go b/gootstrap.go
index 124d2f0..28951a3 100644
--- a/gootstrap.go
+++ b/gootstrap.go
@@ -58,14 +58,8 @@ func generate(name, group string, templateFS fs.FS, templateDir string) {
 	}
 
 	applyTemplate := func(templ string) string {
-		// Why: some files, like Github CI files, have notation identical
-		// To Go templates. So for now we just try to apply the template and if it
-		// fails we assume it should be used as is (not the safest option, but no more time to deal
-		// with this right now).
 		t, err := template.New("templ").Parse(templ)
-		if err != nil {
-			return templ
-		}
+		assert(err)
 		result := bytes.Buffer{}
 		assert(t.Execute(&result, info))
 		return result.String()
diff --git a/templates/basic/.github/workflows/publish.yaml b/templates/basic/.github/workflows/publish.yaml
index 56ac110..51e9245 100644
--- a/templates/basic/.github/workflows/publish.yaml
+++ b/templates/basic/.github/workflows/publish.yaml
@@ -21,8 +21,8 @@ jobs:
         uses: "google-github-actions/auth@v2"
         with:
           token_format: access_token
-          workload_identity_provider: ${{ vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
-          service_account: ${{ vars.GOOGLE_SERVICE_ACCOUNT }}
+          workload_identity_provider: ${{"{{"}} vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER {{"}}"}}
+          service_account: ${{"{{"}} vars.GOOGLE_SERVICE_ACCOUNT {{"}}"}}
           access_token_lifetime: 300s
 
       - name: Login to Artifact Registry
@@ -30,7 +30,7 @@ jobs:
         with:
           registry: us-central1-docker.pkg.dev/birdie-org/birdie
           username: oauth2accesstoken
-          password: ${{ steps.auth.outputs.access_token }}
+          password: ${{"{{"}} steps.auth.outputs.access_token {{"}}"}}
 
       - name: Publish image
         run: |
diff --git a/templates/basic/.github/workflows/release.yaml b/templates/basic/.github/workflows/release.yaml
index 3ea35dd..0ed6464 100644
--- a/templates/basic/.github/workflows/release.yaml
+++ b/templates/basic/.github/workflows/release.yaml
@@ -24,8 +24,8 @@ jobs:
         uses: "google-github-actions/auth@v2"
         with:
           token_format: access_token
-          workload_identity_provider: ${{ vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
-          service_account: ${{ vars.GOOGLE_SERVICE_ACCOUNT }}
+          workload_identity_provider: ${{"{{"}} vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER {{"}}"}}
+          service_account: ${{"{{"}} vars.GOOGLE_SERVICE_ACCOUNT {{"}}"}}
           access_token_lifetime: 300s
 
       - name: Login to Artifact Registry
@@ -33,7 +33,7 @@ jobs:
         with:
           registry: us-central1-docker.pkg.dev/birdie-org/birdie
           username: oauth2accesstoken
-          password: ${{ steps.auth.outputs.access_token }}
+          password: ${{"{{"}} steps.auth.outputs.access_token {{"}}"}}
 
       - name: Release
         run: make release