diff --git a/main.tf b/main.tf
index 71e6225..6c182a8 100644
--- a/main.tf
+++ b/main.tf
@@ -216,7 +216,7 @@ locals {
     config_b64                        = base64encode(local.hocon)
     iglu_config_b64                   = base64encode(local.iglu_resolver)
     accept_limited_use_license        = var.accept_limited_use_license
-    bigquery_service_account_json_b64 = var.bigquery_service_account_json_b64
+    bigquery_service_account_json_b64 = base64decode(var.bigquery_service_account_json_b64)
     telemetry_script                  = join("", module.telemetry.*.gcp_ubuntu_20_04_user_data)
     gcp_logs_enabled                  = var.gcp_logs_enabled
     java_opts                         = var.java_opts
diff --git a/templates/startup-script.sh.tmpl b/templates/startup-script.sh.tmpl
index 39759d9..de0345a 100644
--- a/templates/startup-script.sh.tmpl
+++ b/templates/startup-script.sh.tmpl
@@ -26,7 +26,7 @@ sudo docker run \
   --env JDK_JAVA_OPTIONS='${java_opts}' \
   --env ACCEPT_LIMITED_USE_LICENSE=${accept_limited_use_license} \
 %{ if bigquery_service_account_json_b64 != "" ~}
-  --env BIGQUERY_SERVICE_ACCOUNT_JSON=${bigquery_service_account_json_b64} \
+  --env BIGQUERY_SERVICE_ACCOUNT_JSON='${bigquery_service_account_json_b64}' \
 %{ endif ~}
   --env INSTANCE_ID=$(get_instance_id) \
   snowplow/bigquery-loader-pubsub:${version} \