diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 80017226..a81fe47d 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -1462,7 +1462,7 @@
   items: []
 
 - macro: user_read_sensitive_file_containers
-  condition: (container and container.image.repository in read_sensitive_file_images)
+  condition: (container and container.image.repository in (read_sensitive_file_images))
 
 - rule: Read sensitive file untrusted
   desc: >