diff --git a/tasks/secret-home/task.yaml b/tasks/secret-home/task.yaml
index 409b597..fa94b79 100644
--- a/tasks/secret-home/task.yaml
+++ b/tasks/secret-home/task.yaml
@@ -10,8 +10,8 @@ spec:
       default: ""
 
     - name: keys
-      type: array
-      description: Name of the key(s) to extract from the secret
+      type: string
+      description: Comma-separated keys (e.g. ".gitconfig,.git-credentials")
 
   workspaces:
     - name: shared
@@ -28,7 +28,8 @@ spec:
         set -e
         apk add --no-cache coreutils
 
-        for key in $(params.keys[*]); do
+        IFS=',' read -r -a KEY_ARR <<< "$(params.keys)"
+        for key in "${KEY_ARR[@]}"; do
           echo "encoding $key"
           key_decoded="${key//__//}"
           echo "decoding $key_decoded"