diff --git a/.github/actions/setup-haxe/action.yml b/.github/actions/setup-haxe/action.yml
index a27d8bc68..d0d2178b7 100644
--- a/.github/actions/setup-haxe/action.yml
+++ b/.github/actions/setup-haxe/action.yml
@@ -75,9 +75,9 @@ runs:
     name: Install dependencies
     shell: bash
     run: |
-      git config --global url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf https://github.com/
+      git config --global 'url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf' https://github.com/
       haxelib --global run hmm install -q
-      git config --global --unset url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf
+      git config --global --unset 'url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf'
       echo "TIMER_DONE=$(date +%s)" >> "$GITHUB_ENV"
 
   # by default use a shared hxcpp cache
diff --git a/.github/workflows/build-game.yml b/.github/workflows/build-game.yml
index b262b08df..25c7edcd5 100644
--- a/.github/workflows/build-game.yml
+++ b/.github/workflows/build-game.yml
@@ -105,7 +105,7 @@ jobs:
     - if: ${{ steps.cache-hmm.outputs.cache-hit != 'true' }}
       name: Install dependencies
       run: |
-        git config --global url.https://x-access-token:${{ steps.app_token.outputs.token }}@github.com/.insteadOf https://github.com/
+        git config --global 'url.https://x-access-token:${{ steps.app_token.outputs.token }}@github.com/.insteadOf' https://github.com/
         haxelib --global run hmm install -q
 
     - if: ${{ matrix.target != 'html5' }}