diff --git a/internal/api/incidents.go b/internal/api/incidents.go
index b98a3ff..19c12a1 100644
--- a/internal/api/incidents.go
+++ b/internal/api/incidents.go
@@ -33,8 +33,8 @@ func handleListClusters(db *sql.DB) http.HandlerFunc {
 		label := args.add(originLabel)
 
 		rows, err := db.QueryContext(r.Context(),
-			"SELECT DISTINCT group_labels->>"+label+" AS v FROM incidents WHERE "+
-				strings.Join(where, " AND ")+" AND group_labels->>"+label+" <> '' ORDER BY v LIMIT 200",
+			fmt.Sprintf("SELECT DISTINCT group_labels->>%[1]s AS v FROM incidents WHERE %[2]s AND group_labels->>%[1]s <> '' ORDER BY v LIMIT 200",
+				label, strings.Join(where, " AND ")),
 			args.all()...)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))