From b6672c25e6e1ac1c2187f96aa08e04fa73a1219d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 2 Jan 2025 11:01:08 +0100
Subject: [PATCH] nix-darwin: fix launchd decrypt scripts

---
 modules/nix-darwin/default.nix                   | 2 +-
 modules/nix-darwin/secrets-for-users/default.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nix-darwin/default.nix b/modules/nix-darwin/default.nix
index 9e2f9e4..c886683 100644
--- a/modules/nix-darwin/default.nix
+++ b/modules/nix-darwin/default.nix
@@ -384,7 +384,7 @@ in
       };
 
       launchd.daemons.sops-install-secrets = {
-        command = installScript;
+        command = "sh -c ${lib.escapeShellArg installScript}";
         serviceConfig = {
           RunAtLoad = true;
           KeepAlive = false;
diff --git a/modules/nix-darwin/secrets-for-users/default.nix b/modules/nix-darwin/secrets-for-users/default.nix
index b00395a..14a6a5f 100644
--- a/modules/nix-darwin/secrets-for-users/default.nix
+++ b/modules/nix-darwin/secrets-for-users/default.nix
@@ -42,7 +42,7 @@ in
   };
 
   launchd.daemons.sops-install-secrets-for-users = lib.mkIf (secretsForUsers != [ ]) {
-    command = installScript;
+    command = "sh -c ${lib.escapeShellArg installScript}";
     serviceConfig = {
       RunAtLoad = true;
       KeepAlive = false;