diff --git a/modules/fs/default.nix b/modules/fs/default.nix
index 02ec53c3..9531fbab 100644
--- a/modules/fs/default.nix
+++ b/modules/fs/default.nix
@@ -189,7 +189,7 @@ let
       serviceConfig.Type = "oneshot";
 
       script = wrapper.script;
-      scriptArgs = builtins.concatStringsSep " " wrapper.scriptArgs;
+      scriptArgs = escapeShellArgs wrapper.scriptArgs;
 
       after = gen-opt.depends;
       wants = gen-opt.depends;