diff --git a/scripts/validation/validate_config.sh b/scripts/validation/validate_config.sh
index fb66642..7c36c2f 100644
--- a/scripts/validation/validate_config.sh
+++ b/scripts/validation/validate_config.sh
@@ -102,12 +102,16 @@ _lpvCheckDeployedSecrets()
     # Two different keys holding one value is what a shared placeholder looks
     # like after substitution. Short values are skipped: "true", "admin" and
     # friends repeat legitimately.
+    # The value arrives here unquoted (the sed/tr below strip them) while the
+    # file stores it quoted, so the key lookup has to put the quotes back —
+    # grepping for =<value> against ="<value>" matches nothing and the message
+    # names no keys, which is worse than useless in a failure report.
     local v
     while IFS= read -r v; do
         [[ ${#v} -ge 12 ]] || continue
         local keys
-        keys=$(grep -F "=$v" "$file" | cut -d= -f1 | tr '\n' ' ')
-        _lpvFail "$app: these keys share one value: ${keys}— a secret should never be reused."
+        keys=$(grep -F "=\"$v\"" "$file" | cut -d= -f1 | tr '\n' ' ')
+        _lpvFail "$app: ${keys}share one value — a generated secret should never be reused."
     done < <(grep -oE '^CFG_[A-Z0-9_]+="[^"]{12,}"$' "$file" \
              | sed 's/^[^=]*=//' | tr -d '"' | sort | uniq -d)
 }