Because ${FOO} is already expanded in the Makefile, which leads to
syntax errors in the CI when secrets are replaced by ***, we need to
use $${FOO} so expansion only takes place in the shell.