diff --git a/scripts/kube-ca-refresh.sh b/scripts/kube-ca-refresh.sh
index f80117b..a288a7f 100755
--- a/scripts/kube-ca-refresh.sh
+++ b/scripts/kube-ca-refresh.sh
@@ -56,8 +56,10 @@ if [ -z "$EXPECTED" ]; then
 fi
 
 # Guard against a kubeconfig with no clusters, or an empty one.
-CLUSTER_COUNT=$(kubectl config view --raw -o jsonpath='{.clusters}' 2>/dev/null \
-    | grep -c '"name"' || true)
+# `grep -c` counts LINES, and the jsonpath output is a single line, so the
+# count is done with grep -o and wc -l instead.
+CLUSTER_COUNT=$(kubectl config view --raw -o jsonpath='{.clusters[*].name}' 2>/dev/null \
+    | grep -o . | wc -l || true)
 if [ "${CLUSTER_COUNT:-0}" -eq 0 ]; then
     echo "ERROR: the kubeconfig has no cluster entries." >&2
     echo "  The KUBEC_CONFIG_BUILDX_NEW_2 secret looks wrong or empty." >&2