diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5af04ef..7782920 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -230,14 +230,21 @@ reset_feature:
       import sys
 
       BASE_URL = f"https://orchard-{os.environ['CI_COMMIT_REF_SLUG']}.common.global.bsf.tools"
-      PASSWORD = os.environ.get("DEV_ADMIN_PASSWORD")
+      PASSWORD_RAW = os.environ.get("DEV_ADMIN_PASSWORD")
 
-      if not PASSWORD:
+      if not PASSWORD_RAW:
           print("ERROR: DEV_ADMIN_PASSWORD not set")
           sys.exit(1)
 
-      # Debug: show password info without revealing it
-      print(f"Password length: {len(PASSWORD)}, first char: '{PASSWORD[0] if PASSWORD else '?'}', last char: '{PASSWORD[-1] if PASSWORD else '?'}'")
+      # Debug: check for hidden characters
+      print(f"Raw password repr (first 3 chars): {repr(PASSWORD_RAW[:3])}")
+      print(f"Raw password repr (last 3 chars): {repr(PASSWORD_RAW[-3:])}")
+      print(f"Raw length: {len(PASSWORD_RAW)}")
+
+      # Strip any whitespace
+      PASSWORD = PASSWORD_RAW.strip()
+      print(f"Stripped length: {len(PASSWORD)}")
+
       print(f"Resetting environment at {BASE_URL}")
       client = httpx.Client(base_url=BASE_URL, timeout=60.0)