diff --git a/internal/ghl/webhook.go b/internal/ghl/webhook.go
index 26c207c..75e06f1 100644
--- a/internal/ghl/webhook.go
+++ b/internal/ghl/webhook.go
@@ -14,6 +14,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
@@ -230,7 +231,10 @@ func (h *WebhookHandler) HandleUninstall(w http.ResponseWriter, r *http.Request)
 }
 
 // parseRSAPublicKey decodes a PEM-encoded PKIX RSA public key.
+// Tolerates literal \n sequences in the input (common when the key is stored
+// as a single line in a .env file).
 func parseRSAPublicKey(pemStr string) (*rsa.PublicKey, error) {
+	pemStr = strings.ReplaceAll(pemStr, `\n`, "\n")
 	block, _ := pem.Decode([]byte(pemStr))
 	if block == nil {
 		return nil, fmt.Errorf("failed to decode PEM block")