diff --git a/hosts/common/programs/bonsai.nix b/hosts/common/programs/bonsai.nix
index 26dbf0874..fb6ca6187 100644
--- a/hosts/common/programs/bonsai.nix
+++ b/hosts/common/programs/bonsai.nix
@@ -126,12 +126,12 @@ in
         # TODO: don't create the sway directory here!
         # i do it for now because sway and bonsai call into eachother; circular dependency:
         # - sway -> bonsai -> sane-input-handler -> swaymsg
-        mkdir -p $XDG_RUNTIME_DIR/{bonsai,sway}
-        exec nice -n -11 bonsaid -t $HOME/.config/bonsai/bonsai_tree.json
+        mkdir -p ''${XDG_RUNTIME_DIR}/{bonsai,sway}
+        exec nice -n -11 bonsaid -t ''${HOME}/.config/bonsai/bonsai_tree.json
       '';
-      cleanupCommand = "rm -f $XDG_RUNTIME_DIR/bonsai/bonsai";
+      cleanupCommand = ''rm -f ''${XDG_RUNTIME_DIR}/bonsai/bonsai'';
       readiness.waitExists = [
-        "$XDG_RUNTIME_DIR/bonsai/bonsai"
+        ''''${XDG_RUNTIME_DIR}/bonsai/bonsai''
       ];
     };
   };
diff --git a/hosts/common/programs/feedbackd.nix b/hosts/common/programs/feedbackd.nix
index 35892fad1..b8e3f800d 100644
--- a/hosts/common/programs/feedbackd.nix
+++ b/hosts/common/programs/feedbackd.nix
@@ -101,7 +101,7 @@ in
         "env"
         "G_MESSAGES_DEBUG=all"
       ] ++ lib.optionals cfg.config.proxied [
-        "FEEDBACK_THEME=$HOME/.config/feedbackd/themes/proxied.json"
+        ''FEEDBACK_THEME=''${HOME}/.config/feedbackd/themes/proxied.json''
       ] ++ [
         "${cfg.package}/libexec/feedbackd"
       ]);
diff --git a/hosts/common/programs/pipewire/default.nix b/hosts/common/programs/pipewire/default.nix
index 3ff4c4517..1641f9a21 100644
--- a/hosts/common/programs/pipewire/default.nix
+++ b/hosts/common/programs/pipewire/default.nix
@@ -155,29 +155,29 @@ in
       # env PIPEWIRE_LOG_SYSTEMD=false"
       # env PIPEWIRE_DEBUG="*:3,mod.raop*:5,pw.rtsp-client*:5"
       command = pkgs.writeShellScript "pipewire-start" ''
-        mkdir -p $PIPEWIRE_RUNTIME_DIR
+        mkdir -p ''${PIPEWIRE_RUNTIME_DIR}
         # nice -n -21 comes from pipewire defaults (niceness: -11)
         PIPEWIRE_DEBUG=3 exec nice -n -21 pipewire
       '';
       readiness.waitExists = [
-        "$PIPEWIRE_RUNTIME_DIR/pipewire-0"
-        "$PIPEWIRE_RUNTIME_DIR/pipewire-0-manager"
+        ''''${PIPEWIRE_RUNTIME_DIR}/pipewire-0''
+        ''''${PIPEWIRE_RUNTIME_DIR}/pipewire-0-manager''
       ];
-      cleanupCommand = ''rm -f "$PIPEWIRE_RUNTIME_DIR/{pipewire-0,pipewire-0.lock,pipewire-0-manager,pipewire-0-manager.lock}"'';
+      cleanupCommand = ''rm -f "''${PIPEWIRE_RUNTIME_DIR}/{pipewire-0,pipewire-0.lock,pipewire-0-manager,pipewire-0-manager.lock}"'';
     };
     services.pipewire-pulse = {
       description = "pipewire-pulse: Pipewire compatibility layer for PulseAudio clients";
       depends = [ "pipewire" ];
       partOf = [ "sound" ];
       command = pkgs.writeShellScript "pipewire-pulse-start" ''
-        mkdir -p $XDG_RUNTIME_DIR/pulse
+        mkdir -p ''${XDG_RUNTIME_DIR}/pulse
         exec nice -n -21 pipewire-pulse
       '';
       readiness.waitExists = [
-        "$XDG_RUNTIME_DIR/pulse/native"
-        "$XDG_RUNTIME_DIR/pulse/pid"
+        ''''${XDG_RUNTIME_DIR}/pulse/native''
+        ''''${XDG_RUNTIME_DIR}/pulse/pid''
       ];
-      cleanupCommand = ''rm -f "$XDG_RUNTIME_DIR/pulse/{native,pid}"'';
+      cleanupCommand = ''rm -f "''${XDG_RUNTIME_DIR}/pulse/{native,pid}"'';
     };
 
     # bring up sound by default
diff --git a/hosts/common/programs/schlock.nix b/hosts/common/programs/schlock.nix
index 65ca28c05..11b0e5a61 100644
--- a/hosts/common/programs/schlock.nix
+++ b/hosts/common/programs/schlock.nix
@@ -30,7 +30,7 @@ in
 
     services.schlock = {
       description = "schlock mobile-friendly screen locker";
-      command = ''schlock -p "$HOME/.config/schlock/schlock.pin"'';
+      command = ''schlock -p "''${HOME}/.config/schlock/schlock.pin"'';
       restartCondition = "on-failure";
     };
   };
diff --git a/hosts/common/programs/xdg-desktop-portal.nix b/hosts/common/programs/xdg-desktop-portal.nix
index 0b1291d5a..1f81e2654 100644
--- a/hosts/common/programs/xdg-desktop-portal.nix
+++ b/hosts/common/programs/xdg-desktop-portal.nix
@@ -68,7 +68,7 @@ in
       # arguable if that's a packaging bug, or limitation...
       command = lib.concatStringsSep " " [
         "env"
-        "XDG_DESKTOP_PORTAL_DIR=$HOME/.config/xdg-desktop-portal"
+        ''XDG_DESKTOP_PORTAL_DIR=''${HOME}/.config/xdg-desktop-portal''
         "G_MESSAGES_DEBUG=xdg-desktop-portal=all"
         "${cfg.package}/libexec/xdg-desktop-portal"
       ];
@@ -84,7 +84,7 @@ in
 
       command = lib.concatStringsSep " " [
         "env"
-        "XDG_DESKTOP_PORTAL_DIR=$HOME/.config/xdg-desktop-portal"
+        ''XDG_DESKTOP_PORTAL_DIR=''${HOME}/.config/xdg-desktop-portal''
         "${cfg.package}/libexec/xdg-permission-store"
       ];
       readiness.waitDbus = "org.freedesktop.impl.portal.PermissionStore";