diff --git a/modules/nix-darwin/default.nix b/modules/nix-darwin/default.nix
index 4281d51..9e2f9e4 100644
--- a/modules/nix-darwin/default.nix
+++ b/modules/nix-darwin/default.nix
@@ -171,7 +171,7 @@ let
         ''
           if [[ ! -f ${escapedKeyFile} ]]; then
             echo generating machine-specific age key...
-            mkdir -p $(dirname ${escapedKeyFile})
+            mkdir -p "$(dirname ${escapedKeyFile})"
             # age-keygen sets 0600 by default, no need to chmod.
             ${pkgs.age}/bin/age-keygen -o ${escapedKeyFile}
           fi