diff --git a/docs/release-notes.md b/docs/release-notes.md
index a73ea2a7c..fc388b85b 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -14,6 +14,7 @@ nav_order: 9
 
 ### Bug fixes
 
+- Fix Akamai Ignition base64 decoding on padded payloads
 
 ## Ignition 2.19.0 (2024-06-05)
 
diff --git a/internal/providers/akamai/akamai.go b/internal/providers/akamai/akamai.go
index c7debf3b1..648be3bee 100644
--- a/internal/providers/akamai/akamai.go
+++ b/internal/providers/akamai/akamai.go
@@ -86,11 +86,12 @@ func fetchConfig(f *resource.Fetcher) (types.Config, report.Report, error) {
 	// The Linode Metadata Service requires userdata to be base64-encoded
 	// when it is uploaded, so we will have to decode the response.
 	data := make([]byte, base64.StdEncoding.DecodedLen(len(encoded)))
-	if _, err := base64.StdEncoding.Decode(data, encoded); err != nil {
+	n, err := base64.StdEncoding.Decode(data, encoded)
+	if err != nil {
 		return types.Config{}, report.Report{}, fmt.Errorf("decode base64: %w", err)
 	}
 
-	return util.ParseConfig(f.Logger, data)
+	return util.ParseConfig(f.Logger, data[:n])
 }
 
 // defaultTokenTTL is the time-to-live (TTL; in seconds) for an authorization