diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml
index 53d3c41..fb95627 100644
--- a/bitbucket-pipelines.yml
+++ b/bitbucket-pipelines.yml
@@ -116,8 +116,8 @@ definitions:
           - export AWS_REGION=us-east-1
           - export AWS_ROLE_ARN="arn:aws:iam::975049960860:role/DoczyAI-Bitbucket-OIDC"
           - export AWS_WEB_IDENTITY_TOKEN_FILE="$(pwd)/web-identity-token"
+          # printf (not echo) avoids appending a trailing newline to the JWT
           - printf '%s' "$BITBUCKET_STEP_OIDC_TOKEN" > "$(pwd)/web-identity-token"
-            # printf (not echo) avoids appending a trailing newline to the JWT
 
           # Clone the review agent repo (private — needs BITBUCKET_CLONE_TOKEN)
           # SETUP REQUIRED: set BITBUCKET_CLONE_TOKEN (marked "Secured") in