diff --git a/diskimage_builder/elements/cache-url/bin/cache-url b/diskimage_builder/elements/cache-url/bin/cache-url
index cd260d48..dee05d6e 100755
--- a/diskimage_builder/elements/cache-url/bin/cache-url
+++ b/diskimage_builder/elements/cache-url/bin/cache-url
@@ -61,7 +61,7 @@ done
 url=$1
 dest=$2
 time_cond=
-curl_opts="--retry 3 --retry-delay 30 "
+curl_opts=(--retry 3 --retry-delay 30)
 
 if [ -z $url -o -z $dest ] ; then
     show_options 1
@@ -77,7 +77,7 @@ else
 fi
 
 if [ "$FORCE_REVALIDATE" = "1" ]; then
-    curl_opts+="-H 'Pragma: no-cache, must-revalidate' -H 'Cache-Control: no-cache, must-revalidate'"
+    curl_opts+=(-H "Pragma: no-cache, must-revalidate" -H "Cache-Control: no-cache, must-revalidate")
     success="Downloaded and cached $url, having forced upstream caches to revalidate"
 elif [ -f $dest -a -s $dest ] ; then
     time_cond="-z $dest"
@@ -86,7 +86,7 @@ else
     success="Downloaded and cached $url for the first time"
 fi
 
-rcode=$(curl -v -L -o $tmp -w '%{http_code}' --connect-timeout 10 $curl_opts $url $time_cond)
+rcode=$(curl -v -L -o $tmp -w '%{http_code}' --connect-timeout 10 "${curl_opts[@]}" $url $time_cond)
 if [ "$rcode" == "200" -o "${url:0:7}" == "file://" ] ; then
     # In cases where servers ignore the Modified time,
     # curl cancels the download, outputs a 200 and leaves