diff --git a/roles/paas-docker/wrappers/files/certbot.sh b/roles/paas-docker/wrappers/files/certbot.sh
index a59a813..f7b957b 100755
--- a/roles/paas-docker/wrappers/files/certbot.sh
+++ b/roles/paas-docker/wrappers/files/certbot.sh
@@ -1,23 +1,23 @@
 #!/bin/sh
 
 #   -------------------------------------------------------------
 #   PaaS Docker
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 #   Project:        Nasqueron
 #   Created:        2018-03-15
 #   License:        Trivial work, not eligible to copyright
 #   Source file:    roles/paas-docker/wrappers/files/certbot.sh
 #   -------------------------------------------------------------
 #
 #   <auto-generated>
 #       This file is managed by our rOPS SaltStack repository.
 #
 #       Changes to this file may cause incorrect behavior
 #       and will be lost if the state is redeployed.
 #   </auto-generated>
 
 docker run -it --rm \
 	-v /srv/letsencrypt/etc:/etc/letsencrypt \
 	-v /srv/letsencrypt/var:/var/lib/letsencrypt \
 	-v /srv/letsencrypt/www:/www \
-	certbot/certbot:latest $*
+	certbot/certbot:latest "$@"
diff --git a/roles/phabricator/arcanist/files/arc.sh b/roles/phabricator/arcanist/files/arc.sh
index 832fdb7..d909483 100755
--- a/roles/phabricator/arcanist/files/arc.sh
+++ b/roles/phabricator/arcanist/files/arc.sh
@@ -1,73 +1,73 @@
 #!/bin/sh
 
 #   -------------------------------------------------------------
 #   Phabricator — Arcanist Docker container wrapper
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 #   Author:         Sébastien Santoro aka Dereckson
 #   Project:        Nasqueron
 #   Created:        2016-01-01
 #   Description:    Wrapper to run Arcanist as a Docker container
 #   License:        Trivial work, not eligible to copyright
 #   Image:          nasqueron/arcanist
 #   Source file:    roles/phabricator/arcanist/files/arc.sh
 #   -------------------------------------------------------------
 #
 #   <auto-generated>
 #       This file is managed by our rOPS SaltStack repository.
 #
 #       Changes to this file may cause incorrect behavior
 #       and will be lost if the state is redeployed.
 #   </auto-generated>
 
 #   -------------------------------------------------------------
 #   Parse arguments
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
 if [ -t 0 ]; then
 	# If a stdin entry is available
 	# launch the container in the
 	# interactive mode
 	FLAGS=-it
 fi
 
 # Logs are default disabled
 PRINT_LOG=0
 
 
 if [ "$1" = "shell" ]; then
 	# Launch commands
 	# in the container bash shell
 	shift
 	COMMAND=bash
 else
 	# Launch arc
 	mkdir -p ~/.arc
 	COMMAND=arc
 
 	if [ "$1" = "call-conduit" ]; then
 		# Enable log printing
 		PRINT_LOG=1
 		# Set a random name for the container
 		INSTANCE="arc-"`openssl rand -hex 21`
 		FLAGS="-i -a=stdin --name=$INSTANCE"
 	fi
 fi
 
 if [ -d ~/.arc/ssh ]; then
 	VOLUME_SSH="-v $HOME/.arc/ssh:/root/.ssh"
 else
 	VOLUME_SSH=""
 fi
 
 #   -------------------------------------------------------------
 #   Run container
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
 if [ $PRINT_LOG -eq 0 ]; then
-	docker run $FLAGS --rm -v ~/.arc:/opt/config -v $PWD:/opt/workspace $VOLUME_SSH nasqueron/arcanist $COMMAND $*
+	docker run $FLAGS --rm -v ~/.arc:/opt/config -v $PWD:/opt/workspace $VOLUME_SSH nasqueron/arcanist $COMMAND "$@"
 else
-	docker run $FLAGS -v ~/.arc:/opt/config -v $PWD:/opt/workspace $VOLUME_SSH nasqueron/arcanist $COMMAND $* > /dev/null
+	docker run $FLAGS -v ~/.arc:/opt/config -v $PWD:/opt/workspace $VOLUME_SSH nasqueron/arcanist $COMMAND "$@" > /dev/null
 	sleep 3
 	docker logs $INSTANCE
 	docker rm $INSTANCE >/dev/null
 fi