diff --git a/pkgs/applications/graphics/image_optim/default.nix b/pkgs/applications/graphics/image_optim/default.nix
index 690b7f4e83e..fd7ff021624 100644
--- a/pkgs/applications/graphics/image_optim/default.nix
+++ b/pkgs/applications/graphics/image_optim/default.nix
@@ -39,7 +39,7 @@ bundlerApp {
 
   postBuild = ''
     wrapProgram $out/bin/image_optim \
-      --prefix PATH : ${makeBinPath optionalDepsPath}
+      --prefix PATH : ${lib.escapeShellArg (makeBinPath optionalDepsPath)}
   '';
 
   passthru.updateScript = bundlerUpdateScript "image_optim";
diff --git a/pkgs/applications/graphics/megapixels/default.nix b/pkgs/applications/graphics/megapixels/default.nix
index 64782cc7fcc..9ce07df3437 100644
--- a/pkgs/applications/graphics/megapixels/default.nix
+++ b/pkgs/applications/graphics/megapixels/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   preFixup = optionalString (tiffSupport || jpgSupport) ''
     gappsWrapperArgs+=(
-      --prefix PATH : ${runtimePath}
+      --prefix PATH : ${lib.escapeShellArg runtimePath}
     )
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/chatty/default.nix b/pkgs/applications/networking/instant-messengers/chatty/default.nix
index 2b8edf319cf..35266eff900 100644
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix PURPLE_PLUGIN_PATH : ${pidgin.makePluginPath plugins}
+      --prefix PURPLE_PLUGIN_PATH : ${lib.escapeShellArg (pidgin.makePluginPath plugins)}
       ${lib.concatMapStringsSep " " (p: p.wrapArgs or "") plugins}
     )
   '';
diff --git a/pkgs/applications/networking/p2p/tremc/default.nix b/pkgs/applications/networking/p2p/tremc/default.nix
index ea6b92c08e7..6ff10989b1d 100644
--- a/pkgs/applications/networking/p2p/tremc/default.nix
+++ b/pkgs/applications/networking/p2p/tremc/default.nix
@@ -44,7 +44,7 @@ python3Packages.buildPythonApplication rec {
   dontBuild = true;
   doCheck = false;
 
-  makeWrapperArgs = ["--prefix PATH : ${wrapperPath}"];
+  makeWrapperArgs = ["--prefix PATH : ${lib.escapeShellArg wrapperPath}"];
 
   installPhase = ''
     make DESTDIR=$out install
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index 6e7f0f3d517..1e34b7918da 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
       --add-flags "-cp $out/share/java/jameica.jar:$out/share/jameica-${version}/* ${
         lib.optionalString stdenv.isDarwin ''-Xdock:name="Jameica" -XstartOnFirstThread''
       } de.willuhn.jameica.Main" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
+      --prefix LD_LIBRARY_PATH : ${lib.escapeShellArg (lib.makeLibraryPath buildInputs)} \
       --chdir "$out/share/java/"
   '';
 
diff --git a/pkgs/applications/radio/soapysdr/default.nix b/pkgs/applications/radio/soapysdr/default.nix
index 4875a4818f8..1e5052d4f9b 100644
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation {
     done
     # Needed for at least the remote plugin server
     for file in $out/bin/*; do
-        wrapProgram "$file" --prefix SOAPY_SDR_PLUGIN_PATH : ${extraPackagesSearchPath}
+        wrapProgram "$file" --prefix SOAPY_SDR_PLUGIN_PATH : ${lib.escapeShellArg extraPackagesSearchPath}
     done
   '';
 
diff --git a/pkgs/applications/science/electronics/qucs-s/default.nix b/pkgs/applications/science/electronics/qucs-s/default.nix
index 6507198a790..9c692865f6e 100644
--- a/pkgs/applications/science/electronics/qucs-s/default.nix
+++ b/pkgs/applications/science/electronics/qucs-s/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     # Make custom kernels avaible from qucs-s
-    gappsWrapperArgs+=(--prefix PATH ":" ${lib.makeBinPath kernels})
+    gappsWrapperArgs+=(--prefix PATH ":" ${lib.escapeShellArg (lib.makeBinPath kernels)})
   '';
 
   QTDIR=qt4;
diff --git a/pkgs/applications/video/vdr/wrapper.nix b/pkgs/applications/video/vdr/wrapper.nix
index 04984212b24..431d2dae4f0 100644
--- a/pkgs/applications/video/vdr/wrapper.nix
+++ b/pkgs/applications/video/vdr/wrapper.nix
@@ -17,7 +17,7 @@ in symlinkJoin {
   postBuild = ''
     wrapProgram $out/bin/vdr \
       --add-flags "-L $out/lib/vdr --localedir=$out/share/locale" \
-      --prefix XINE_PLUGIN_PATH ":" ${makeXinePluginPath requiredXinePlugins}
+      --prefix XINE_PLUGIN_PATH ":" ${lib.escapeShellArg (makeXinePluginPath requiredXinePlugins)}
   '';
 
   meta = with vdr.meta; {
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index fa3a50bc535..48a08f51844 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -76,5 +76,5 @@ in runCommand podman.name {
   ln -s ${podman-unwrapped}/share $out/share
   makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
     --set CONTAINERS_HELPER_BINARY_DIR ${helpersBin}/bin \
-    --prefix PATH : ${binPath}
+    --prefix PATH : ${lib.escapeShellArg binPath}
 ''
diff --git a/pkgs/applications/window-managers/i3/blocks-gaps.nix b/pkgs/applications/window-managers/i3/blocks-gaps.nix
index 4acc2fb669c..deb0c99c313 100644
--- a/pkgs/applications/window-managers/i3/blocks-gaps.nix
+++ b/pkgs/applications/window-managers/i3/blocks-gaps.nix
@@ -28,17 +28,21 @@ stdenv.mkDerivation rec {
   buildInputs = optional (contains_any scripts perlscripts) perl;
   nativeBuildInputs = [ makeWrapper ];
 
-  postFixup = ''
+  postFixup = optionalString (elem "bandwidth" scripts) ''
     wrapProgram $out/libexec/i3blocks/bandwidth \
-      --prefix PATH : ${makeBinPath (optional (elem "bandwidth" scripts) iproute2)}
+      --prefix PATH : ${makeBinPath [ iproute2 ]}
+  '' + optionalString (elem "battery" scripts) ''
     wrapProgram $out/libexec/i3blocks/battery \
-      --prefix PATH : ${makeBinPath (optional (elem "battery" scripts) acpi)}
+      --prefix PATH : ${makeBinPath [ acpi ]}
+  '' + optionalString (elem "cpu_usage" scripts) ''
     wrapProgram $out/libexec/i3blocks/cpu_usage \
-      --prefix PATH : ${makeBinPath (optional (elem "cpu_usage" scripts) sysstat)}
+      --prefix PATH : ${makeBinPath [ sysstat ]}
+  '' + optionalString (elem "iface" scripts) ''
     wrapProgram $out/libexec/i3blocks/iface \
-      --prefix PATH : ${makeBinPath (optional (elem "iface" scripts) iproute2)}
+      --prefix PATH : ${makeBinPath [ iproute2 ]}
+  '' + optionalString (elem "volume" scripts) ''
     wrapProgram $out/libexec/i3blocks/volume \
-      --prefix PATH : ${makeBinPath (optional (elem "volume" scripts) alsa-utils)}
+      --prefix PATH : ${makeBinPath [ alsa-utils ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/hunspell/wrapper.nix b/pkgs/development/libraries/hunspell/wrapper.nix
index 4ae17723275..d67fe230103 100644
--- a/pkgs/development/libraries/hunspell/wrapper.nix
+++ b/pkgs/development/libraries/hunspell/wrapper.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   name = (appendToName "with-dicts" hunspell).name;
   nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
-    makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${searchPath}
+    makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${lib.escapeShellArg searchPath}
   '';
   meta = removeAttrs hunspell.meta ["outputsToInstall"];
 }
diff --git a/pkgs/development/libraries/nuspell/wrapper.nix b/pkgs/development/libraries/nuspell/wrapper.nix
index ab09931579c..64108c33b7c 100644
--- a/pkgs/development/libraries/nuspell/wrapper.nix
+++ b/pkgs/development/libraries/nuspell/wrapper.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   name = (appendToName "with-dicts" nuspell).name;
   nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
-    makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${searchPath}
+    makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${lib.escapeShellArg searchPath}
   '';
   meta = removeAttrs nuspell.meta ["outputsToInstall"];
 }
diff --git a/pkgs/development/tools/continuous-integration/hci/default.nix b/pkgs/development/tools/continuous-integration/hci/default.nix
index 5c0c59845ce..0919a6ec58b 100644
--- a/pkgs/development/tools/continuous-integration/hci/default.nix
+++ b/pkgs/development/tools/continuous-integration/hci/default.nix
@@ -12,7 +12,7 @@ let
           ${o.postInstall or ""}
           mkdir -p $out/libexec
           mv $out/bin/hci $out/libexec
-          makeWrapper $out/libexec/hci $out/bin/hci --prefix PATH : ${makeBinPath bundledBins}
+          makeWrapper $out/libexec/hci $out/bin/hci --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
         '';
       })
       (addBuildDepends [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-cli));
diff --git a/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix b/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
index 00ae501e534..ec1e6fb93b2 100644
--- a/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
@@ -12,7 +12,7 @@ let
           ${o.postInstall or ""}
           mkdir -p $out/libexec
           mv $out/bin/hercules-ci-agent $out/libexec
-          makeWrapper $out/libexec/hercules-ci-agent $out/bin/hercules-ci-agent --prefix PATH : ${makeBinPath bundledBins}
+          makeWrapper $out/libexec/hercules-ci-agent $out/bin/hercules-ci-agent --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
         '';
       })
       (addBuildDepends [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-agent));
diff --git a/pkgs/development/tools/misc/sqitch/default.nix b/pkgs/development/tools/misc/sqitch/default.nix
index 5e3c3bc37c6..f941ab05e28 100644
--- a/pkgs/development/tools/misc/sqitch/default.nix
+++ b/pkgs/development/tools/misc/sqitch/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
   '';
   dontStrip = true;
   postFixup = ''
-    wrapProgram $out/bin/sqitch --prefix PERL5LIB : ${perlPackages.makeFullPerlPath modules}
+    wrapProgram $out/bin/sqitch --prefix PERL5LIB : ${lib.escapeShellArg (perlPackages.makeFullPerlPath modules)}
   '';
 
   meta = {
diff --git a/pkgs/servers/misc/navidrome/default.nix b/pkgs/servers/misc/navidrome/default.nix
index 17e648e59ab..ea1cae99dd9 100644
--- a/pkgs/servers/misc/navidrome/default.nix
+++ b/pkgs/servers/misc/navidrome/default.nix
@@ -32,9 +32,9 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  postFixup = ''
+  postFixup = optionalString ffmpegSupport ''
     wrapProgram $out/bin/navidrome \
-      --prefix PATH : ${makeBinPath (optional ffmpegSupport ffmpeg)}
+      --prefix PATH : ${makeBinPath [ ffmpeg ]}
   '';
 
   passthru.tests.navidrome = nixosTests.navidrome;
diff --git a/pkgs/servers/pufferpanel/default.nix b/pkgs/servers/pufferpanel/default.nix
index 1f0395d2fb2..d89a859b898 100644
--- a/pkgs/servers/pufferpanel/default.nix
+++ b/pkgs/servers/pufferpanel/default.nix
@@ -47,7 +47,7 @@ buildGoModule rec {
       --set PUFFER_PANEL_EMAIL_TEMPLATES $out/share/pufferpanel/templates/emails.json \
       --set GIN_MODE release \
       --set PUFFER_PANEL_WEB_FILES $out/share/pufferpanel/www \
-      --prefix PATH : ${lib.makeBinPath pathDeps}
+      --prefix PATH : ${lib.escapeShellArg (lib.makeBinPath pathDeps)}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
index 56ddf93af45..e4394028658 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
@@ -20,7 +20,7 @@ symlinkJoin {
   postBuild = ''
     for i in bin/emoji-picker libexec/ibus-{setup,engine}-typing-booster; do
       wrapProgram "$out/$i" \
-        --prefix NIX_HUNSPELL_DIRS : ${hunspellDirs}
+        --prefix NIX_HUNSPELL_DIRS : ${lib.escapeShellArg hunspellDirs}
     done
 
     sed -i -e "s,${typing-booster},$out," $out/share/ibus/component/typing-booster.xml