diff --git a/nixos/modules/programs/command-not-found/command-not-found.nix b/nixos/modules/programs/command-not-found/command-not-found.nix
index 79786584c666..4d2a89b51584 100644
--- a/nixos/modules/programs/command-not-found/command-not-found.nix
+++ b/nixos/modules/programs/command-not-found/command-not-found.nix
@@ -49,10 +49,10 @@ in
       ''
         # This function is called whenever a command is not found.
         command_not_found_handle() {
-          local p=${commandNotFound}/bin/command-not-found
-          if [ -x $p -a -f ${cfg.dbPath} ]; then
+          local p='${commandNotFound}/bin/command-not-found'
+          if [ -x "$p" ] && [ -f '${cfg.dbPath}' ]; then
             # Run the helper program.
-            $p "$@"
+            "$p" "$@"
             # Retry the command if we just installed it.
             if [ $? = 126 ]; then
               "$@"
@@ -70,10 +70,10 @@ in
       ''
         # This function is called whenever a command is not found.
         command_not_found_handler() {
-          local p=${commandNotFound}/bin/command-not-found
-          if [ -x $p -a -f ${cfg.dbPath} ]; then
+          local p='${commandNotFound}/bin/command-not-found'
+          if [ -x "$p" ] && [ -f '${cfg.dbPath}' ]; then
             # Run the helper program.
-            $p "$@"
+            "$p" "$@"
 
             # Retry the command if we just installed it.
             if [ $? = 126 ]; then