diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index 6c9b71624c2b..fb4559875917 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -111,7 +111,7 @@ let
   init = run: writeShellScript "${name}-init" ''
     source /etc/profile
     ${createLdConfCache}
-    exec ${run} "$@"
+    exec ${lib.escapeShellArg run} "$@"
   '';
 
   indentLines = str: lib.concatLines (map (s: "  " + s) (filter (s: s != "") (lib.splitString "\n" str)));