diff --git a/roles/base/templates/krb5.conf.j2 b/roles/base/templates/krb5.conf.j2
index 01f28d645c..5cad5d7674 100644
--- a/roles/base/templates/krb5.conf.j2
+++ b/roles/base/templates/krb5.conf.j2
@@ -20,7 +20,7 @@
 {% else %}
   kdc = https://id{{ env_suffix }}.fedoraproject.org/KdcProxy
 {% endif %}
-{% if ansible_hostname|default('').startswith('koji') %}
+{% if (ansible_hostname|default('')).startswith('koji') %}
   # This maps "A/B@FP.O" to "A/B@FP.O", and is used for gss localname in koji gssapi
   auth_to_local = RULE:[2:$1/$2@$0](.*)
   auth_to_local = DEFAULT