diff --git a/tests/functional/ca/signatures.sh b/tests/functional/ca/signatures.sh
index eb18a4130..f69a205d2 100644
--- a/tests/functional/ca/signatures.sh
+++ b/tests/functional/ca/signatures.sh
@@ -1,10 +1,12 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
 clearCache
 
-nix-store --generate-binary-cache-key cache1.example.org $TEST_ROOT/sk1 $TEST_ROOT/pk1
-pk1=$(cat $TEST_ROOT/pk1)
+nix-store --generate-binary-cache-key cache1.example.org "$TEST_ROOT/sk1" "$TEST_ROOT/pk1"
+pk1=$(cat "$TEST_ROOT/pk1")
 
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
@@ -19,16 +21,16 @@ testOneCopy () {
     rm -rf "$REMOTE_STORE_DIR"
 
     attrPath="$1"
-    nix copy -vvvv --to $REMOTE_STORE "$attrPath" --file ./content-addressed.nix \
+    nix copy -vvvv --to "$REMOTE_STORE" "$attrPath" --file ./content-addressed.nix \
         --secret-key-files "$TEST_ROOT/sk1" --show-trace
 
     ensureCorrectlyCopied "$attrPath"
 
     # Ensure that we can copy back what we put in the store
     clearStore
-    nix copy --from $REMOTE_STORE \
+    nix copy --from "$REMOTE_STORE" \
         --file ./content-addressed.nix "$attrPath" \
-        --trusted-public-keys $pk1
+        --trusted-public-keys "$pk1"
 }
 
 for attrPath in rootCA dependentCA transitivelyDependentCA dependentNonCA dependentFixedOutput; do