diff --git a/live/secrets/terragrunt.hcl b/live/secrets/terragrunt.hcl
index 45b83f2..ab2f9bc 100644
--- a/live/secrets/terragrunt.hcl
+++ b/live/secrets/terragrunt.hcl
@@ -128,8 +128,12 @@ locals {
 
   # secret_ref's ref is a plain "vault://path#field" string (unlike the other
   # source kinds, whose ref is an object) - only meaningful for source_kind=secret_ref.
+  # source.ref is a string for secret_ref but an object for every other
+  # source.kind (postgresql_user/kafka_user/rabbitmq_user/s3_bucket/valkey_user)
+  # - HCL's conditional requires both branches to share a static type, so the
+  # object branch is forced through tostring()/try() to collapse to "".
   v2_source_ref_string = { for secret in local.secrets_v2 : secret.id =>
-    local.v2_source_kind[secret.id] == "secret_ref" ? try(secret.source.ref, "") : ""
+    local.v2_source_kind[secret.id] == "secret_ref" ? try(tostring(secret.source.ref), "") : ""
   }
 
   v2_extra_fields = { for secret in local.secrets_v2 : secret.id => {