diff --git a/modules/backrest/default.nix b/modules/backrest/default.nix
index 9a54c82..71894f2 100644
--- a/modules/backrest/default.nix
+++ b/modules/backrest/default.nix
@@ -19,7 +19,7 @@ let
         uri = "sftp:dnsc-storage:restic/dnsc-server";
         password = "file:${config.age.secrets."restic/password".path}";
         flags = [
-          "-o sftp.args=-i /root/.ssh/id_ed25519 -o StrictHostKeyChecking=accept-new"
+          "-o 'sftp.args=-i /root/.ssh/id_ed25519 -o StrictHostKeyChecking=accept-new'"
         ];
         autoInitialize = true;
         prunePolicy = {