diff --git a/service/internal/executor/executor.go b/service/internal/executor/executor.go
index 5fe2dec..694cc9b 100644
--- a/service/internal/executor/executor.go
+++ b/service/internal/executor/executor.go
@@ -718,13 +718,18 @@ func filterToDefinedArgumentsOnly(req *ExecutionRequest) {
 	}
 	filtered := make(map[string]string)
 	for k, v := range req.Arguments {
-		if _, ok := definedNames[k]; ok || strings.HasPrefix(k, "ot_") {
+		if keepArgument(k, definedNames) {
 			filtered[k] = v
 		}
 	}
 	req.Arguments = filtered
 }
 
+func keepArgument(name string, definedNames map[string]struct{}) bool {
+	_, ok := definedNames[name]
+	return ok || strings.HasPrefix(name, "ot_")
+}
+
 func hasWebhookTag(req *ExecutionRequest) bool {
 	for _, tag := range req.Tags {
 		if tag == "webhook" {
diff --git a/service/internal/executor/executor_test.go b/service/internal/executor/executor_test.go
index 00a4535..2608bbe 100644
--- a/service/internal/executor/executor_test.go
+++ b/service/internal/executor/executor_test.go
@@ -366,8 +366,8 @@ func TestFilterToDefinedArgumentsOnly(t *testing.T) {
 		},
 	}
 	req.Arguments = map[string]string{
-		"name":           "Alice",
-		"webhook_path":   "/malicious/$(id)",
+		"name":            "Alice",
+		"webhook_path":    "/malicious/$(id)",
 		"extra_undefined": "ignored",
 	}
 
@@ -381,13 +381,13 @@ func TestFilterToDefinedArgumentsOnly(t *testing.T) {
 func TestFilterToDefinedArgumentsPreservesSystemArgs(t *testing.T) {
 	req := newExecRequest()
 	req.Binding.Action = &config.Action{
-		Title: "Filter test",
-		Shell: "echo test",
+		Title:     "Filter test",
+		Shell:     "echo test",
 		Arguments: []config.ActionArgument{},
 	}
 	req.Arguments = map[string]string{
 		"ot_executionTrackingId": "track-123",
-		"ot_username":             "webhook",
+		"ot_username":            "webhook",
 	}
 
 	filterToDefinedArgumentsOnly(req)
diff --git a/service/internal/tpl/templates_test.go b/service/internal/tpl/templates_test.go
index d46f902..b49fe33 100644
--- a/service/internal/tpl/templates_test.go
+++ b/service/internal/tpl/templates_test.go
@@ -62,20 +62,25 @@ func TestParseTemplateWithActionContext_Json(t *testing.T) {
 			}
 			assert.NoError(t, err)
 			if tt.checkJsonOnly {
-				prefix := strings.TrimSuffix(tt.expectedOutput, " ")
-				assert.True(t, strings.HasPrefix(output, prefix), "output %q should start with %q", output, prefix)
-				jsonPart := strings.TrimPrefix(output, prefix)
-				jsonPart = strings.TrimSpace(jsonPart)
-				var decoded map[string]string
-				err := json.Unmarshal([]byte(jsonPart), &decoded)
-				assert.NoError(t, err)
-				for k, v := range tt.args {
-					assert.Equal(t, v, decoded[k], "decoded JSON should contain %s=%s", k, v)
-				}
-				assert.Len(t, decoded, len(tt.args))
+				assertJsonOutput(t, output, tt.expectedOutput, tt.args)
 			} else {
 				assert.Equal(t, tt.expectedOutput, output)
 			}
 		})
 	}
 }
+
+func assertJsonOutput(t *testing.T, output, expectedPrefix string, args map[string]string) {
+	t.Helper()
+	prefix := strings.TrimSuffix(expectedPrefix, " ")
+	assert.True(t, strings.HasPrefix(output, prefix), "output %q should start with %q", output, prefix)
+	jsonPart := strings.TrimPrefix(output, prefix)
+	jsonPart = strings.TrimSpace(jsonPart)
+	var decoded map[string]string
+	err := json.Unmarshal([]byte(jsonPart), &decoded)
+	assert.NoError(t, err)
+	for k, v := range args {
+		assert.Equal(t, v, decoded[k], "decoded JSON should contain %s=%s", k, v)
+	}
+	assert.Len(t, decoded, len(args))
+}
diff --git a/service/internal/webhooks/handler_test.go b/service/internal/webhooks/handler_test.go
index 48a2108..30831aa 100644
--- a/service/internal/webhooks/handler_test.go
+++ b/service/internal/webhooks/handler_test.go
@@ -16,9 +16,9 @@ func TestFilterToDefinedArguments(t *testing.T) {
 		},
 	}
 	args := map[string]string{
-		"repo":            "my-repo",
-		"branch":          "main",
-		"webhook_path":    "/deploy/prod",
+		"repo":                    "my-repo",
+		"branch":                  "main",
+		"webhook_path":            "/deploy/prod",
 		"webhook_header_x_custom": "malicious",
 	}