diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85c24b88c1..420b9b6375 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -292,14 +292,15 @@ jobs:
         if: github.event_name != 'pull_request_target' && github.ref == 'refs/heads/main'
         uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
 
-      - name: Sign images with Cosign
+      - name: Sign image with Cosign
         if: github.event_name != 'pull_request_target' && github.ref == 'refs/heads/main'
         env:
           DIGEST: ${{ steps.build-docker.outputs.digest }}
           TAGS: ${{ steps.image-tags.outputs.tags }}
         run: |
+          IFS="," read -a tags <<< "${TAGS}"
           images=""
-          for tag in ${TAGS}; do
+          for tag in "${tags[@]}"; do
             images+="${tag}@${DIGEST} "
           done
           cosign sign --yes ${images}