diff --git a/.github/workflows/deltatest.yml b/.github/workflows/deltatest.yml
index 19067edde..60a1f752f 100644
--- a/.github/workflows/deltatest.yml
+++ b/.github/workflows/deltatest.yml
@@ -79,20 +79,24 @@ jobs:
 
       # Write config.toml so Delta connects to the remote mapping DB.
       # Without repo_id, Delta falls back to building a local mapping from scratch.
+      # NOTE: heredocs inside YAML `run:` blocks indent the content with spaces,
+      # producing invalid TOML. Use explicit echo statements instead.
       - name: Configure Delta Cloud
         env:
           DELTA_API_KEY: ${{ secrets.DELTA_API_KEY }}
           DELTA_REPO_ID: ${{ secrets.DELTA_REPO_ID }}
         run: |
           mkdir -p .delta
-          cat > .delta/config.toml <<EOF
-          [cloud]
-          api_key = "${DELTA_API_KEY}"
-          api_url = "https://api.deltatest.dev"
-          repo_id = "${DELTA_REPO_ID}"
-          branch   = "master"
-          test_dir = "tests"
-          EOF
+          {
+            echo '[cloud]'
+            echo "api_key  = \"${DELTA_API_KEY}\""
+            echo 'api_url  = "https://api.deltatest.dev"'
+            echo "repo_id  = \"${DELTA_REPO_ID}\""
+            echo 'branch   = "master"'
+            echo 'test_dir = "tests"'
+          } > .delta/config.toml
+          # Verify structure (values masked)
+          sed 's/= ".*"/= "***"/' .delta/config.toml
 
       # ── Run only tests affected by this diff ─────────────────────────────
       - name: Run Delta (affected tests only)
diff --git a/.github/workflows/tests-ubuntu.yml b/.github/workflows/tests-ubuntu.yml
index 2d22e5441..55d93d06c 100644
--- a/.github/workflows/tests-ubuntu.yml
+++ b/.github/workflows/tests-ubuntu.yml
@@ -73,20 +73,24 @@ jobs:
 
       # Write config.toml so Delta connects to the remote mapping DB.
       # Without repo_id, Delta falls back to building a local mapping from scratch.
+      # NOTE: heredocs inside YAML `run:` blocks indent the content with spaces,
+      # producing invalid TOML. Use explicit echo statements instead.
       - name: Configure Delta Cloud
         env:
           DELTA_API_KEY: ${{ secrets.DELTA_API_KEY }}
           DELTA_REPO_ID: ${{ secrets.DELTA_REPO_ID }}
         run: |
           mkdir -p .delta
-          cat > .delta/config.toml <<EOF
-          [cloud]
-          api_key = "${DELTA_API_KEY}"
-          api_url = "https://api.deltatest.dev"
-          repo_id = "${DELTA_REPO_ID}"
-          branch   = "master"
-          test_dir = "tests"
-          EOF
+          {
+            echo '[cloud]'
+            echo "api_key  = \"${DELTA_API_KEY}\""
+            echo 'api_url  = "https://api.deltatest.dev"'
+            echo "repo_id  = \"${DELTA_REPO_ID}\""
+            echo 'branch   = "master"'
+            echo 'test_dir = "tests"'
+          } > .delta/config.toml
+          # Verify structure (values masked)
+          sed 's/= ".*"/= "***"/' .delta/config.toml
 
       - name: Run Delta (affected tests only)
         run: |