diff --git a/internal/pkg/deploy/cloudformation/stack/transformers.go b/internal/pkg/deploy/cloudformation/stack/transformers.go
index 2c0373abeb5..8b0c7642ebb 100644
--- a/internal/pkg/deploy/cloudformation/stack/transformers.go
+++ b/internal/pkg/deploy/cloudformation/stack/transformers.go
@@ -854,16 +854,33 @@ func convertMountPoints(input map[string]*manifest.Volume) []*template.MountPoin
 	if len(input) == 0 {
 		return nil
 	}
+
+	// Sort by names for consistent testing
+	var names []string
+	for name := range input {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+
 	var output []*template.MountPoint
-	for name, volume := range input {
+	for _, name := range names {
+		volume := input[name]
 		output = append(output, convertMountPoint(aws.String(name), volume.ContainerPath, volume.ReadOnly))
 	}
 	return output
 }
 
 func convertEFSPermissions(input map[string]*manifest.Volume) []*template.EFSPermission {
+	// Sort by names for consistent testing
+	var names []string
+	for name := range input {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+
 	var output []*template.EFSPermission
-	for _, volume := range input {
+	for _, name := range names {
+		volume := input[name]
 		// If there's no EFS configuration, we don't need to generate any permissions.
 		if volume.EmptyVolume() {
 			continue
@@ -893,8 +910,16 @@ func convertEFSPermissions(input map[string]*manifest.Volume) []*template.EFSPer
 }
 
 func convertManagedFSInfo(wlName *string, input map[string]*manifest.Volume) *template.ManagedVolumeCreationInfo {
+	// Sort by names for consistent testing
+	var names []string
+	for name := range input {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+
 	var output *template.ManagedVolumeCreationInfo
-	for name, volume := range input {
+	for _, name := range names {
+		volume := input[name]
 		if volume.EmptyVolume() || !volume.EFS.UseManagedFS() {
 			continue
 		}
@@ -923,8 +948,16 @@ func getRandomUIDGID(name *string) uint32 {
 }
 
 func convertVolumes(input map[string]*manifest.Volume) []*template.Volume {
+	// Sort by names for consistent testing
+	var names []string
+	for name := range input {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+
 	var output []*template.Volume
-	for name, volume := range input {
+	for _, name := range names {
+		volume := input[name]
 		// Volumes can contain either:
 		//   a) an EFS configuration, which must be valid
 		//   b) no EFS configuration, in which case the volume is created using task scratch storage in order to share
diff --git a/internal/pkg/template/templates/workloads/services/rd-web/cf.yml b/internal/pkg/template/templates/workloads/services/rd-web/cf.yml
index a91654654d1..f0e47e3380f 100644
--- a/internal/pkg/template/templates/workloads/services/rd-web/cf.yml
+++ b/internal/pkg/template/templates/workloads/services/rd-web/cf.yml
@@ -100,9 +100,9 @@ Resources:
             {{- end}}
             {{- if .NestedStack}}{{$stackName := .NestedStack.StackName}}
             {{- range $secret := .NestedStack.SecretOutputs}}
-            - Name: {{toSnakeCase $secret}}
-              Value:
-                Fn::GetAtt: [{{$stackName}}, Outputs.{{$secret}}]
+              - Name: {{toSnakeCase $secret}}
+                Value:
+                  Fn::GetAtt: [{{$stackName}}, Outputs.{{$secret}}]
             {{- end}}
             {{- end}}
             RuntimeEnvironmentVariables: