diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 21dcf9c2e..711b31ee4 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -106,7 +106,6 @@
             enable = true;
             excludes = [
               # We haven't linted these files yet
-              ''^tests/functional/secure-drv-outputs\.sh$''
               ''^tests/functional/selfref-gc\.sh$''
               ''^tests/functional/shell\.shebang\.sh$''
               ''^tests/functional/simple\.builder\.sh$''
diff --git a/tests/functional/secure-drv-outputs.sh b/tests/functional/secure-drv-outputs.sh
index 5cc4af435..876d3c817 100755
--- a/tests/functional/secure-drv-outputs.sh
+++ b/tests/functional/secure-drv-outputs.sh
@@ -13,20 +13,20 @@ clearStore
 startDaemon
 
 # Determine the output path of the "good" derivation.
-goodOut=$(nix-store -q $(nix-instantiate ./secure-drv-outputs.nix -A good))
+goodOut=$(nix-store -q "$(nix-instantiate ./secure-drv-outputs.nix -A good)")
 
 # Instantiate the "bad" derivation.
 badDrv=$(nix-instantiate ./secure-drv-outputs.nix -A bad)
-badOut=$(nix-store -q $badDrv)
+badOut=$(nix-store -q "$badDrv")
 
 # Rewrite the bad derivation to produce the output path of the good
 # derivation.
-rm -f $TEST_ROOT/bad.drv
-sed -e "s|$badOut|$goodOut|g" < $badDrv > $TEST_ROOT/bad.drv
+rm -f "$TEST_ROOT"/bad.drv
+sed -e "s|$badOut|$goodOut|g" < "$badDrv" > "$TEST_ROOT"/bad.drv
 
 # Add the manipulated derivation to the store and build it.  This
 # should fail.
-if badDrv2=$(nix-store --add $TEST_ROOT/bad.drv); then
+if badDrv2=$(nix-store --add "$TEST_ROOT"/bad.drv); then
     nix-store -r "$badDrv2"
 fi