diff --git a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-manifest.yml b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-manifest.yml
index 7f702026a47..91e06831d51 100644
--- a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-manifest.yml
+++ b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-manifest.yml
@@ -7,7 +7,7 @@ http:
     - name: example.com
       hosted_zone: mockHostedZone2
     - name: foobar.com
-    - name: v1.foobar.com
+    - name: "*.foobar.com"
   hosted_zone: mockHostedZone1
 
 image:
diff --git a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml
index 57d390cfb69..d9a9ca61454 100644
--- a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml
+++ b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml
@@ -278,12 +278,12 @@ Resources:
       HostedZoneId: mockHostedZone1
       Comment: !Sub "LoadBalancer aliases for service ${WorkloadName} in hosted zone mockHostedZone1"
       RecordSets:
-        - Name: foobar.com
+        - Name: "foobar.com"
           Type: A
           AliasTarget:
             HostedZoneId: !GetAtt EnvControllerAction.InternalLoadBalancerHostedZone
             DNSName: !GetAtt EnvControllerAction.InternalLoadBalancerDNSName
-        - Name: v1.foobar.com
+        - Name: "*.foobar.com"
           Type: A
           AliasTarget:
             HostedZoneId: !GetAtt EnvControllerAction.InternalLoadBalancerHostedZone
@@ -296,7 +296,7 @@ Resources:
       HostedZoneId: mockHostedZone2
       Comment: !Sub "LoadBalancer aliases for service ${WorkloadName} in hosted zone mockHostedZone2"
       RecordSets:
-        - Name: example.com
+        - Name: "example.com"
           Type: A
           AliasTarget:
             HostedZoneId: !GetAtt EnvControllerAction.InternalLoadBalancerHostedZone
@@ -326,7 +326,7 @@ Resources:
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com, foobar.com, v1.foobar.com]
+            Values: ["example.com", "foobar.com", "*.foobar.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
@@ -347,7 +347,7 @@ Resources:
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com, foobar.com, v1.foobar.com]
+            Values: ["example.com", "foobar.com", "*.foobar.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
diff --git a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-grpc-test.stack.yml b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-grpc-test.stack.yml
index 8275dc55918..9d36ad7ba12 100644
--- a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-grpc-test.stack.yml
+++ b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-grpc-test.stack.yml
@@ -524,7 +524,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
@@ -545,7 +545,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
diff --git a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-prod.stack.yml b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-prod.stack.yml
index edac436fca4..5000bc960b5 100644
--- a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-prod.stack.yml
+++ b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-prod.stack.yml
@@ -611,7 +611,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
@@ -632,7 +632,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
diff --git a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-staging.stack.yml b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-staging.stack.yml
index 03156e29e22..e0f816d6d81 100644
--- a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-staging.stack.yml
+++ b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-staging.stack.yml
@@ -397,7 +397,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       HostedZoneId: mockHostedZone
       Comment: !Sub "LoadBalancer aliases for service ${WorkloadName} in hosted zone mockHostedZone"
       RecordSets:
-        - Name: example.com
+        - Name: "example.com"
           Type: A
           AliasTarget:
             HostedZoneId: !GetAtt EnvControllerAction.PublicLoadBalancerHostedZone
@@ -427,7 +427,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
@@ -448,7 +448,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
diff --git a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-test.stack.yml b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-test.stack.yml
index 135e8ece177..acaeb742526 100644
--- a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-test.stack.yml
+++ b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/svc-test.stack.yml
@@ -523,7 +523,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
@@ -544,7 +544,7 @@ Resources: # If a bucket URL is specified, that means the template exists.
       Conditions:
         - Field: 'host-header'
           HostHeaderConfig:
-            Values: [example.com]
+            Values: ["example.com"]
         - Field: 'path-pattern'
           PathPatternConfig:
             Values: !If
diff --git a/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml b/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml
index 240be018367..1951f98e871 100644
--- a/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml
+++ b/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml
@@ -6,7 +6,7 @@ EnvControllerAction:
     ServiceToken: !GetAtt EnvControllerFunction.Arn
     Workload: !Ref WorkloadName
 {{- if and (not .UseImportedCerts) (.Aliases)}}
-    Aliases: {{ fmtSlice .Aliases }}
+    Aliases: {{ fmtSlice (quoteSlice .Aliases) }}
 {{- end}}
     EnvStack: !Sub '${AppName}-${EnvName}'
     Parameters: {{ envControllerParams . }}
diff --git a/internal/pkg/template/templates/workloads/partials/cf/https-listener.yml b/internal/pkg/template/templates/workloads/partials/cf/https-listener.yml
index e35ed26ab48..dac2b67b36c 100644
--- a/internal/pkg/template/templates/workloads/partials/cf/https-listener.yml
+++ b/internal/pkg/template/templates/workloads/partials/cf/https-listener.yml
@@ -31,7 +31,7 @@ LoadBalancerDNSAlias{{$hostedZoneID}}:
     Comment: !Sub "LoadBalancer aliases for service ${WorkloadName} in hosted zone {{$hostedZoneID}}"
     RecordSets:
     {{- range $alias := $aliases}}
-      - Name: {{$alias}}
+      - Name: {{quote $alias}}
         Type: A
         AliasTarget:
           {{- if eq $.WorkloadType "Backend Service"}}
@@ -76,7 +76,7 @@ HTTPListenerRuleWithDomain:
 {{- if .Aliases }}
       - Field: 'host-header'
         HostHeaderConfig:
-          Values: {{ fmtSlice .Aliases }}
+          Values: {{ fmtSlice (quoteSlice .Aliases) }}
 {{- else }}
       - Field: 'host-header'
         HostHeaderConfig:
@@ -124,7 +124,7 @@ HTTPSListenerRule:
 {{- if .Aliases }}
       - Field: 'host-header'
         HostHeaderConfig:
-          Values: {{ fmtSlice .Aliases }}
+          Values: {{ fmtSlice (quoteSlice .Aliases) }}
 {{- else }}
       - Field: 'host-header'
         HostHeaderConfig:
diff --git a/internal/pkg/template/workload.go b/internal/pkg/template/workload.go
index 5b882ac803d..03287c39b01 100644
--- a/internal/pkg/template/workload.go
+++ b/internal/pkg/template/workload.go
@@ -6,6 +6,7 @@ package template
 import (
 	"bytes"
 	"fmt"
+	"strconv"
 	"text/template"
 
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
@@ -611,6 +612,7 @@ func withSvcParsingFuncs() ParseOption {
 			"hasSecrets":           hasSecrets,
 			"fmtSlice":             FmtSliceFunc,
 			"quoteSlice":           QuoteSliceFunc,
+			"quote":                strconv.Quote,
 			"randomUUID":           randomUUIDFunc,
 			"jsonMountPoints":      generateMountPointJSON,
 			"jsonSNSTopics":        generateSNSJSON,