diff --git a/templates/r10k/hook_config.erb b/templates/r10k/hook_config.erb
index 361d011..2ffd78c 100644
--- a/templates/r10k/hook_config.erb
+++ b/templates/r10k/hook_config.erb
@@ -12,12 +12,18 @@
       "and": [
         {
           "match": {
-            "type": "payload",
+            "type": "payload-hash-sha1",
+            "secret": "<%= @pt_webhook_secret %>"
+          }
+        },
+        {
+          "match": {
+            "type": "value",
+            "value": "refs/heads/production",
             "parameter": {
-              "source": "jsonpath",
-              "name": "$.ref"
-            },
-            "value": "refs/heads/production"
+              "source": "payload",
+              "name": "ref"
+            }
           }
         }
       ]