diff --git a/modules/programs/zsh/plugins/oh-my-zsh.nix b/modules/programs/zsh/plugins/oh-my-zsh.nix
index f4461dc00..6c6dfda25 100644
--- a/modules/programs/zsh/plugins/oh-my-zsh.nix
+++ b/modules/programs/zsh/plugins/oh-my-zsh.nix
@@ -5,7 +5,13 @@
   ...
 }:
 let
-  inherit (lib) mkOption optionalString types;
+  inherit (lib)
+    escapeShellArg
+    escapeShellArgs
+    mkOption
+    optionalString
+    types
+    ;
 
   inherit (import ../lib.nix { inherit config lib; }) dotDirRel;
 
@@ -75,8 +81,8 @@ in
 
       file = {
         "${dotDirRel}/.zshenv".text = ''
-          ZSH="${cfg.oh-my-zsh.package}/share/oh-my-zsh";
-          ZSH_CACHE_DIR="${config.xdg.cacheHome}/oh-my-zsh";
+          ZSH=${escapeShellArg cfg.oh-my-zsh.package}/share/oh-my-zsh;
+          ZSH_CACHE_DIR=${escapeShellArg config.xdg.cacheHome}/oh-my-zsh;
         '';
 
         # Make sure we create a cache directory since some plugins expect it to exist
@@ -91,9 +97,9 @@ in
       # oh-my-zsh configuration generated by NixOS
       ${optionalString (
         cfg.oh-my-zsh.plugins != [ ]
-      ) "plugins=(${lib.concatStringsSep " " cfg.oh-my-zsh.plugins})"}
-      ${optionalString (cfg.oh-my-zsh.custom != "") ''ZSH_CUSTOM="${cfg.oh-my-zsh.custom}"''}
-      ${optionalString (cfg.oh-my-zsh.theme != "") ''ZSH_THEME="${cfg.oh-my-zsh.theme}"''}
+      ) "plugins=(${lib.concatStringsSep " " (escapeShellArgs cfg.oh-my-zsh.plugins)})"}
+      ${optionalString (cfg.oh-my-zsh.custom != "") "ZSH_CUSTOM=${escapeShellArg cfg.oh-my-zsh.custom}"}
+      ${optionalString (cfg.oh-my-zsh.theme != "") "ZSH_THEME=${escapeShellArg cfg.oh-my-zsh.theme}"}
       source $ZSH/oh-my-zsh.sh
     '';
   };