diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 2d19901..c7e56ab 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -57,7 +57,8 @@ jobs:
         env:
           WAHLRECHT_MONGODB_CONNECTION_STRING: ${{ secrets.WAHLRECHT_MONGODB_CONNECTION_STRING }}
         run: |
-          sed -i "s|<wahlrecht_mongodb_connection_string>|$WAHLRECHT_MONGODB_CONNECTION_STRING|g" docker/${{ matrix.env }}/stack-config/wahlrecht.yaml
+          ESCAPED=$(printf '%s' "$WAHLRECHT_MONGODB_CONNECTION_STRING" | sed 's/&/\\&/g')
+          sed -i "s|<wahlrecht_mongodb_connection_string>|$ESCAPED|g" docker/${{ matrix.env }}/stack-config/wahlrecht.yaml
       - name: Copy files to remote
         if: steps.check.outputs.should_deploy == 'true'
         uses: burnett01/rsync-deployments@7.0.2