diff --git a/design/20200326.extensible-certificate-controller.md b/design/20200326.extensible-certificate-controller.md
index a10c1f64c..07b373a9e 100644
--- a/design/20200326.extensible-certificate-controller.md
+++ b/design/20200326.extensible-certificate-controller.md
@@ -238,14 +238,14 @@ resources that are owned by Certificates.
               store it in the Secret resource.
 
 * If the `Issuing` condition is `False` or not set:
-    * Delete all owned Secret resources with the `cert-manager.io/next-private-key: "true`
+    * Delete all owned Secret resources with the `cert-manager.io/next-private-key: "true"`
     * Ensure `status.nextPrivateKeySecretName` is unset - we may want to
       consider not doing this in case a user has manually specified this field
       and pointed it at an 'un-owned' Secret. This depends whether we want to
       support this as a mode of operation.
 
 When creating a 'next private key' Secret resource, the
-`cert-manager.io/next-private-key: "true` annotation is added as well as an
+`cert-manager.io/next-private-key: "true"` annotation is added as well as an
 OwnerReference to the Certificate resource.
 
 Private keys generated by the key manager will be encoded in PKCS#8 format for