diff --git a/templates/r10k/hook_config.erb b/templates/r10k/hook_config.erb
index f362670..d99fe69 100644
--- a/templates/r10k/hook_config.erb
+++ b/templates/r10k/hook_config.erb
@@ -11,6 +11,12 @@
 
     "trigger-rule": {
       "and": [
+        {
+          "match": {
+            "type": "payload-hash-sha1",
+            "secret": "<%= @pt_webhook_secret %>"
+          }
+        },
         {
           "match": {
             "type": "payload",