diff --git a/CHANGELOG.md b/CHANGELOG.md
index 829e1483b27dff0006c9a7ca8524ea94f8e49bfd..89738bb2be63d6f7d0c2e6e448920651316e8c71 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [6.6.4](https://gitlab.com/to-be-continuous/python/compare/6.6.3...6.6.4) (2024-2-2)
+
+
+### Bug Fixes
+
+* sanitize variable substitution pattern ([c1cf8c3](https://gitlab.com/to-be-continuous/python/commit/c1cf8c387f37dfdc29958d9168f13736707f135f))
+
 ## [6.6.3](https://gitlab.com/to-be-continuous/python/compare/6.6.2...6.6.3) (2024-1-26)
 
 
diff --git a/README.md b/README.md
index e0225585c65567d60d76e8ab41b78650cfe885c5..bba97d0009872900171bf883ac9ea04e1b63df10 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Add the following to your `gitlab-ci.yml`:
 ```yaml
 include:
   # 1: include the component
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.6.3
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.6.4
     # 2: set/override component inputs
     inputs:
       image: registry.hub.docker.com/library/python:3.10
@@ -29,7 +29,7 @@ Add the following to your `gitlab-ci.yml`:
 include:
   # 1: include the template
   - project: 'to-be-continuous/python'
-    ref: '6.6.3'
+    ref: '6.6.4'
     file: '/templates/gitlab-ci-python.yml'
 
 variables:
@@ -454,9 +454,9 @@ With:
 ```yaml
 include:
   # main component
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.6.3
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.6.4
   # Vault variant
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python-vault@6.6.3
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python-vault@6.6.4
     inputs:
       vault-base-url: "https://vault.acme.host/v1"
       # audience claim for JWT
diff --git a/templates/gitlab-ci-python-vault.yml b/templates/gitlab-ci-python-vault.yml
index 1316aed6d7fcf2392347eec2276eb63ae97372ae..9c5bc07b8e172de51afd4458ced228a481c0f4ba 100644
--- a/templates/gitlab-ci-python-vault.yml
+++ b/templates/gitlab-ci-python-vault.yml
@@ -22,7 +22,7 @@ variables:
 .python-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "python", "6.6.3"]
+      command: ["--service", "python", "6.6.4"]
     - name: "$TBC_VAULT_IMAGE"
       alias: "vault-secrets-provider"
   variables:
diff --git a/templates/gitlab-ci-python.yml b/templates/gitlab-ci-python.yml
index 9c0bb48cacdbc5bde0504b0ad27066b1831d38a9..47b8be9d2743a32bb3005ea7146566cca91c6889 100644
--- a/templates/gitlab-ci-python.yml
+++ b/templates/gitlab-ci-python.yml
@@ -794,7 +794,7 @@ stages:
   image: $PYTHON_IMAGE
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "python", "6.6.3"]
+      command: ["--service", "python", "6.6.4"]
   # Cache downloaded dependencies and plugins between builds.
   # To keep cache across branches add 'key: "$CI_JOB_NAME"'
   cache: