diff --git a/hooks/luks/luks.init b/hooks/luks/luks.init
index 193d2d8..a3b56b1 100644
--- a/hooks/luks/luks.init
+++ b/hooks/luks/luks.init
@@ -12,6 +12,6 @@ resolve_device "$luks_root"
 
 DM_DISABLE_UDEV=1 cryptsetup open \
     ${luks_discard:+--allow-discards} \
-    ${luks_header:+--header=$luks_header} \
-    ${luks_key:+--key-file=$luks_key} -- "$device" \
+    ${luks_header:+--header="$luks_header"} \
+    ${luks_key:+--key-file="$luks_key"} -- "$device" \
     "${luks_name:-crypt-${device##*/}}" || panic "failed to unlock LUKS"