diff --git a/internal/validators/regex_validator.go b/internal/validators/regex_validator.go
index 05d513f..ac9cf65 100644
--- a/internal/validators/regex_validator.go
+++ b/internal/validators/regex_validator.go
@@ -23,6 +23,11 @@ func (v RegexValidator) MarkdownDescription(ctx context.Context) string {
 
 //nolint:gocritic // Implements Terraform defined interface
 func (v RegexValidator) ValidateString(ctx context.Context, req validator.StringRequest, resp *validator.StringResponse) {
+	// skip validation if the value is still unknown, which is the case for vars before evaluation
+	if req.ConfigValue.IsUnknown() {
+		return
+	}
+
 	r := regexp.MustCompile(v.RegexPattern)
 
 	if !r.MatchString(req.ConfigValue.ValueString()) {
diff --git a/internal/validators/ssh_key_validator.go b/internal/validators/ssh_key_validator.go
index 71b833b..c9991c3 100644
--- a/internal/validators/ssh_key_validator.go
+++ b/internal/validators/ssh_key_validator.go
@@ -20,6 +20,11 @@ func (v SSHKeyValidator) MarkdownDescription(ctx context.Context) string {
 
 //nolint:gocritic // Implements Terraform defined interface
 func (v SSHKeyValidator) ValidateString(ctx context.Context, req validator.StringRequest, resp *validator.StringResponse) {
+	// skip validation if the value is still unknown, which is the case for vars before evaluation
+	if req.ConfigValue.IsUnknown() {
+		return
+	}
+
 	input := req.ConfigValue.ValueString()
 
 	_, _, _, _, err := ssh.ParseAuthorizedKey([]byte(input))