diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index e7b02ee88b00..a4ae4e2c7ffc 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -482,11 +482,12 @@ in
         ln -s --force ${cfg.qemu.package}/bin/qemu-pr-helper /run/${dirName}/nix-helpers/
 
         # Symlink to OVMF firmware code and variable template images distributed with QEMU
-        cp -sfv $(
+        readarray -t firmware_files < <(
           ${pkgs.jq}/bin/jq -rs \
             '[.[] | .mapping.executable.filename, .mapping."nvram-template".filename] | unique | .[]' \
-          ${cfg.qemu.package}/share/qemu/firmware/* \
-        ) /run/${dirName}/nix-ovmf
+          ${cfg.qemu.package}/share/qemu/firmware/*
+        )
+        cp -sfv "''${firmware_files[@]}" /run/${dirName}/nix-ovmf
 
         # Symlink hooks to /var/lib/libvirt
         ${concatStringsSep "\n" (
@@ -544,6 +545,8 @@ in
         OOMScoreAdjust = "-999";
       };
       restartIfChanged = false;
+
+      enableStrictShellChecks = true;
     };
 
     systemd.services.virtchd = {