diff --git a/modules/users/default.nix b/modules/users/default.nix
index 08785be8..9f906b32 100644
--- a/modules/users/default.nix
+++ b/modules/users/default.nix
@@ -114,7 +114,7 @@ in
         if [ -z "$g" ]; then
           echo "creating group ${v.name}..." >&2
           dscl . -create ${dsclGroup} PrimaryGroupID ${toString v.gid}
-          dscl . -create ${dsclGroup} RealName '${v.description}'
+          dscl . -create ${dsclGroup} RealName ${lib.escapeShellArg v.description}
           g=${toString v.gid}
         fi
 
diff --git a/tests/users-groups.nix b/tests/users-groups.nix
index 87babb3a..d15909b3 100644
--- a/tests/users-groups.nix
+++ b/tests/users-groups.nix
@@ -26,7 +26,7 @@
 
     # checking group creation in /activate
     grep "dscl . -create ${lib.escapeShellArg "/Groups/foo"} PrimaryGroupID 42000" ${config.out}/activate
-    grep "dscl . -create ${lib.escapeShellArg "/Groups/foo"} RealName 'Foo group'" ${config.out}/activate
+    grep "dscl . -create ${lib.escapeShellArg "/Groups/foo"} RealName ${lib.escapeShellArg "Foo group"}" ${config.out}/activate
     grep "dscl . -create ${lib.escapeShellArg "/Groups/created.group"} PrimaryGroupID 42001" ${config.out}/activate
     grep -qv "dscl . -delete ${lib.escapeShellArg "/Groups/created.group"}" ${config.out}/activate