KES not generating file from secret

[samvanryssegem-qz]

kubernetes: v1.20
kes: v6.4.0

Given this external secret definition I'm expecting to get a file called config.json which contains my secret.

kind: ExternalSecret
metadata:
  name: lacework-config
spec:  
  backendType: vault
  kvVersion: 2
  # Your authentication mount point, e.g. "kubernetes"
  vaultMountPoint: {{ .Values.token.vaultMountPoint }}
  # The vault role that will be used to fetch the secrets
  # This role will need to be bound to kubernetes-external-secret's ServiceAccount; see Vault's documentation:
  # https://www.vaultproject.io/docs/auth/kubernetes.html
  vaultRole: {{ .Values.token.vaultRole }}
  data:
  - name: access-token
    key: secret/data/cd/lacework-access-token
    property: lacework-access-token
  template:
    metadata:
    labels: 
      argocd.argoproj.io/instance: argocd-app
    data:
      config.json: |
        <%= data.access-token %>

When I run kubectl -n lacework-agent get secret lacework-config -o yaml I receive the following secret definition which is missing my config.json file.

apiVersion: v1
data:
  access-token: MYSECRETVALUE
kind: Secret
metadata:
  creationTimestamp: "2021-09-13T22:05:34Z"
  name: lacework-config
  namespace: lacework-agent
  ownerReferences:
  - apiVersion: kubernetes-client.io/v1
    controller: true
    kind: ExternalSecret
    name: lacework-config
    uid: eaa0be74-c7d7-41b1-8367-2ac65eef1562
  resourceVersion: "295298750"
  uid: b5dfb2b0-aa28-435f-b39a-f96c9eab22c2
type: Opaque

Am I doing something wrong here? This looks like what the templating example has.