diff --git a/modules/services/nextdns/default.nix b/modules/services/nextdns/default.nix
index 23120965..adc9823e 100644
--- a/modules/services/nextdns/default.nix
+++ b/modules/services/nextdns/default.nix
@@ -31,7 +31,7 @@ in {
     launchd.daemons.nextdns = {
       path = [ nextdns ];
       serviceConfig.ProgramArguments =
-        [ "${pkgs.nextdns}/bin/nextdns" "run" (escapeShellArgs cfg.arguments) ];
+        [ "${pkgs.nextdns}/bin/nextdns" "run" ] ++ cfg.arguments;
       serviceConfig.KeepAlive = true;
       serviceConfig.RunAtLoad = true;
     };
diff --git a/tests/services-nextdns.nix b/tests/services-nextdns.nix
index 4d6224f2..02ce1a58 100644
--- a/tests/services-nextdns.nix
+++ b/tests/services-nextdns.nix
@@ -12,6 +12,7 @@ in {
     echo >&2 "checking nextdns service in ~/Library/LaunchDaemons"
     grep "org.nixos.nextdns" ${config.out}/Library/LaunchDaemons/org.nixos.nextdns.plist
     grep "/bin/nextdns" ${config.out}/Library/LaunchDaemons/org.nixos.nextdns.plist
-    grep "'-config' '10.0.3.0/24=abcdef'" ${config.out}/Library/LaunchDaemons/org.nixos.nextdns.plist
+    grep -- "-config" ${config.out}/Library/LaunchDaemons/org.nixos.nextdns.plist
+    grep "10.0.3.0/24=abcdef" ${config.out}/Library/LaunchDaemons/org.nixos.nextdns.plist
   '';
 }