diff --git a/enroll/manifest.py b/enroll/manifest.py
index b51aa74..8fb3dd2 100644
--- a/enroll/manifest.py
+++ b/enroll/manifest.py
@@ -400,7 +400,7 @@ Unowned /etc config files not attributed to packages or services.
     state: started
   when:
     - _unit_probe is succeeded
-    - {{ var_prefix }}_start | bool
+    - {var_prefix}_start | bool
 """
         )
 
diff --git a/tests/test_manifest.py b/tests/test_manifest.py
index 8759e69..09c66e1 100644
--- a/tests/test_manifest.py
+++ b/tests/test_manifest.py
@@ -96,7 +96,7 @@ def test_manifest_writes_roles_and_playbook_with_clean_when(tmp_path: Path):
 
     # Service role: conditional start must be a clean Ansible expression
     tasks = (out / "roles" / "foo" / "tasks" / "main.yml").read_text(encoding="utf-8")
-    assert "when:\n    - _unit_probe is succeeded\n    - { var_prefix }_start | bool\n" in tasks
+    assert "when:\n    - _unit_probe is succeeded\n    - foo_start | bool\n" in tasks
     # Ensure we didn't emit deprecated/broken '{{ }}' delimiters in when:
     for line in tasks.splitlines():
         if line.lstrip().startswith("when:"):