2 files changed, 7 insertions, 5 deletions
diff --git a/pkgs/build-support/bintools-wrapper/add-hardening.sh b/pkgs/build-support/bintools-wrapper/add-hardening.sh
index 19321fcb18b..2ed36df3e1d 100644
--- a/pkgs/build-support/bintools-wrapper/add-hardening.sh
+++ b/pkgs/build-support/bintools-wrapper/add-hardening.sh
@@ -6,7 +6,7 @@ declare -A hardeningEnableMap=()
 # array expansion also prevents undefined variables from causing trouble with
 # `set -u`.
 for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
-  hardeningEnableMap[$flag]=1
+  hardeningEnableMap["$flag"]=1
 done
 
 # Remove unsupported flags.
@@ -15,9 +15,10 @@ for flag in @hardening_unsupported_flags@; do
 done
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  # Determine which flags were effectively disabled so we can report below.
   declare -a allHardeningFlags=(pie relro bindnow)
   declare -A hardeningDisableMap=()
+
+  # Determine which flags were effectively disabled so we can report below.
   for flag in "${allHardeningFlags[@]}"; do
     if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
       hardeningDisableMap[$flag]=1
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index c8c95d2def4..6799899ef89 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -6,7 +6,7 @@ declare -A hardeningEnableMap=()
 # array expansion also prevents undefined variables from causing trouble with
 # `set -u`.
 for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
-  hardeningEnableMap[$flag]=1
+  hardeningEnableMap["$flag"]=1
 done
 
 # Remove unsupported flags.
@@ -15,12 +15,13 @@ for flag in @hardening_unsupported_flags@; do
 done
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  # Determine which flags were effectively disabled so we can report below.
   declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
   declare -A hardeningDisableMap=()
+
+  # Determine which flags were effectively disabled so we can report below.
   for flag in "${allHardeningFlags[@]}"; do
     if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
-      hardeningDisableMap[$flag]=1
+      hardeningDisableMap["$flag"]=1
     fi
   done