diff --git a/modules/age-home.nix b/modules/age-home.nix
index b242c29..20bf50d 100644
--- a/modules/age-home.nix
+++ b/modules/age-home.nix
@@ -67,7 +67,7 @@ with lib; let
 
   substituteSecret = secretType:
     builtins.concatStringsSep "\n" (builtins.map (file: ''
-        ${pkgs.gnused}/bin/sed -i "s#@${secretType.name}@#$(cat ${secretType.path})#" ${file}
+        ${pkgs.gnused}/bin/sed -i "s#@${secretType.name}@#$(cat "${secretType.path}")#" ${file}
       '')
       secretType.substitutions);