diff --git a/pkgs/build-support/fetchpatch/default.nix b/pkgs/build-support/fetchpatch/default.nix
index 16343d626ce7..c8004fb8743c 100644
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@@ -23,8 +23,8 @@ fetchurl ({
         --clean "$out" > "$tmpfile"
     ${patchutils}/bin/filterdiff \
       -p1 \
-      ${builtins.toString (builtins.map (x: "-x ${x}") excludes)} \
-      ${builtins.toString (builtins.map (x: "-i ${x}") includes)} \
+      ${builtins.toString (builtins.map (x: "-x ${lib.escapeShellArg x}") excludes)} \
+      ${builtins.toString (builtins.map (x: "-i ${lib.escapeShellArg x}") includes)} \
       "$tmpfile" > "$out"
     ${args.postFetch or ""}
   '';