diff --git a/.github/workflows/build-firmware.yaml b/.github/workflows/build-firmware.yaml
index 1b5719ae94..e2ee2bf4d0 100644
--- a/.github/workflows/build-firmware.yaml
+++ b/.github/workflows/build-firmware.yaml
@@ -264,7 +264,7 @@ jobs:
       working-directory: ./artifacts
       run: |
         source ../firmware/config/boards/common_script_read_meta_env.inc ../firmware/${{ env.BOARD_META_PATH }}
-        bash ../firmware/bin/upload_bundle.sh ${{ secrets.RUSEFI_SSH_USER }} ${{ secrets.RUSEFI_SSH_PASS }} ${{ secrets.RUSEFI_SSH_SERVER }} ${BUNDLE_NAME}
+        bash ../firmware/bin/upload_bundle.sh ${{ secrets.RUSEFI_SSH_USER }} "${{ secrets.RUSEFI_SSH_PASS }}" ${{ secrets.RUSEFI_SSH_SERVER }} ${BUNDLE_NAME}
 
     - name: Add Bundles to Release
       if: ${{ env.full == 'true' && env.upload == 'release' }}
@@ -284,7 +284,7 @@ jobs:
       run: |
         source config/boards/common_script_read_meta_env.inc ${{ env.BOARD_META_PATH }}
         cd ${META_OUTPUT_ROOT_FOLDER}tunerstudio/generated
-        ${OLDPWD}/tunerstudio/upload_ini.sh ${{ secrets.RUSEFI_ONLINE_FTP_USER }} ${{ secrets.RUSEFI_ONLINE_FTP_PASS }} ${{ secrets.RUSEFI_FTP_SERVER }}
+        ${OLDPWD}/tunerstudio/upload_ini.sh ${{ secrets.RUSEFI_ONLINE_FTP_USER }} "${{ secrets.RUSEFI_ONLINE_FTP_PASS }}" ${{ secrets.RUSEFI_FTP_SERVER }}
 
     - name: Upload github action elf artifact
       if: ${{ env.partial == 'true' }}
diff --git a/.github/workflows/custom-board-build/action.yaml b/.github/workflows/custom-board-build/action.yaml
index b8e705d67e..0573db759b 100644
--- a/.github/workflows/custom-board-build/action.yaml
+++ b/.github/workflows/custom-board-build/action.yaml
@@ -297,7 +297,7 @@ runs:
       if: ${{ contains(inputs.uploads, 'ini') }}
       working-directory: ${{inputs.rusefi_dir}}/firmware/${{env.META_OUTPUT_ROOT_FOLDER}}tunerstudio/generated
       shell: bash
-      run: ${{github.workspace}}/${{inputs.rusefi_dir}}/firmware/tunerstudio/upload_ini.sh ${{ inputs.RUSEFI_ONLINE_FTP_USER }} ${{ inputs.RUSEFI_ONLINE_FTP_PASS }} ${{ inputs.RUSEFI_FTP_SERVER }}
+      run: ${{github.workspace}}/${{inputs.rusefi_dir}}/firmware/tunerstudio/upload_ini.sh ${{ inputs.RUSEFI_ONLINE_FTP_USER }} "${{ inputs.RUSEFI_ONLINE_FTP_PASS }}" ${{ inputs.RUSEFI_FTP_SERVER }}
 
     - name: Upload github action bin artifact
       if: ${{ contains(inputs.artifacts, 'bin') }}
@@ -366,7 +366,7 @@ runs:
       if: ${{ contains(inputs.artifacts, 'obfuscated') }}
       working-directory: ${{inputs.rusefi_dir}}/artifacts
       shell: bash
-      run: bash ../firmware/bin/upload_bundle.sh ${{ inputs.RUSEFI_OBFUSCATED_PUBLIC_SSH_USER }} ${{ inputs.RUSEFI_OBFUSCATED_PUBLIC_SSH_PASS }} ${{ inputs.RUSEFI_OBFUSCATED_PUBLIC_SSH_SERVER }} "${{env.SHORT_BOARD_NAME}}_obfuscated_public"
+      run: bash ../firmware/bin/upload_bundle.sh ${{ inputs.RUSEFI_OBFUSCATED_PUBLIC_SSH_USER }} "${{ inputs.RUSEFI_OBFUSCATED_PUBLIC_SSH_PASS }}" ${{ inputs.RUSEFI_OBFUSCATED_PUBLIC_SSH_SERVER }} "${{env.SHORT_BOARD_NAME}}_obfuscated_public"
 
     - name: Upload github action bundle obfuscated_public artifact
       if: ${{ contains(inputs.artifacts, 'obfuscated') }}
diff --git a/firmware/bin/upload_bundle.sh b/firmware/bin/upload_bundle.sh
index ab0203b8a1..5084b4bcab 100755
--- a/firmware/bin/upload_bundle.sh
+++ b/firmware/bin/upload_bundle.sh
@@ -33,10 +33,10 @@ if [ -n "${USER}" -a -n "$PASS" -a -n "${HOST}" ]; then
  else
    DESTINATION_FOLDER="${bundle_upload_folder}"
  fi
- tar -czf - $FULL_BUNDLE_FILE    | sshpass -p $PASS ssh -o StrictHostKeyChecking=no ${USER}@${HOST} "mkdir -p ${DESTINATION_FOLDER};            tar -xzf - -C ${DESTINATION_FOLDER}"
+ tar -czf - $FULL_BUNDLE_FILE    | sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no ${USER}@${HOST} "mkdir -p ${DESTINATION_FOLDER};            tar -xzf - -C ${DESTINATION_FOLDER}"
  RET=$((RET+$?+PIPESTATUS))
  if [ -f $UPDATE_BUNDLE_FILE ]; then
-   tar -czf - $UPDATE_BUNDLE_FILE  | sshpass -p $PASS ssh -o StrictHostKeyChecking=no ${USER}@${HOST} "mkdir -p ${DESTINATION_FOLDER}/autoupdate; tar -xzf - -C ${DESTINATION_FOLDER}/autoupdate"
+   tar -czf - $UPDATE_BUNDLE_FILE  | sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no ${USER}@${HOST} "mkdir -p ${DESTINATION_FOLDER}/autoupdate; tar -xzf - -C ${DESTINATION_FOLDER}/autoupdate"
    RET=$((RET+$?+PIPESTATUS))
  else
     echo "File $UPDATE_BUNDLE_FILE does not exist."