diff --git a/deploy/flux-kustomization.yaml b/deploy/flux-kustomization.yaml
index 7f5c3dd..1a77c74 100644
--- a/deploy/flux-kustomization.yaml
+++ b/deploy/flux-kustomization.yaml
@@ -51,5 +51,9 @@ spec:
       # "false" so a workflow can read $env.<AGENT>_CLIENT_SECRET. It means any
       # workflow on this instance can read any variable in the pod — acceptable
       # while it runs only this estate's agents, and not a moment longer.
-      BLOCK_ENV_ACCESS: "false"
-      EXECUTIONS_MAX_AGE_HOURS: "336"
+      BLOCK_ENV_ACCESS: '"false"'
+      # Quoted inside the value on purpose: these land in a ConfigMap, whose
+      # values must be strings, and the template cannot force it — kustomize
+      # strips quotes before substitution runs. Without the inner quotes the
+      # apply fails on the type.
+      EXECUTIONS_MAX_AGE_HOURS: '"336"'