diff --git a/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-bsp/trusted-firmware-a/tf-a-stm32mp_2.10.bbappend b/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-bsp/trusted-firmware-a/tf-a-stm32mp_2.10.bbappend
index 539664690..2c0125e4e 100644
--- a/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-bsp/trusted-firmware-a/tf-a-stm32mp_2.10.bbappend
+++ b/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-bsp/trusted-firmware-a/tf-a-stm32mp_2.10.bbappend
@@ -212,7 +212,7 @@ do_compile() {
                         # The encryption key is already available in hexadecimal format, so just extract it from file
                         encrypt_key="$(cat ${encrypt_key})"
                     else
-                        encrypt_key="$(hexdump -e '/1 "%02x"' ${encrypt_key})"
+                        encrypt_key="$(hexdump -ve '/1 "%02x"' "${encrypt_key}")"
                     fi
                     encrypt_extra_opt="ENC_KEY=${encrypt_key}"
             fi