diff --git a/modules/nix-darwin/default.nix b/modules/nix-darwin/default.nix
index 9e2f9e4..c886683 100644
--- a/modules/nix-darwin/default.nix
+++ b/modules/nix-darwin/default.nix
@@ -384,7 +384,7 @@ in
       };
 
       launchd.daemons.sops-install-secrets = {
-        command = installScript;
+        command = "sh -c ${lib.escapeShellArg installScript}";
         serviceConfig = {
           RunAtLoad = true;
           KeepAlive = false;
diff --git a/modules/nix-darwin/secrets-for-users/default.nix b/modules/nix-darwin/secrets-for-users/default.nix
index b00395a..14a6a5f 100644
--- a/modules/nix-darwin/secrets-for-users/default.nix
+++ b/modules/nix-darwin/secrets-for-users/default.nix
@@ -42,7 +42,7 @@ in
   };
 
   launchd.daemons.sops-install-secrets-for-users = lib.mkIf (secretsForUsers != [ ]) {
-    command = installScript;
+    command = "sh -c ${lib.escapeShellArg installScript}";
     serviceConfig = {
       RunAtLoad = true;
       KeepAlive = false;