diff --git a/quartz/cli/plugin-git-handlers.js b/quartz/cli/plugin-git-handlers.js
index 48cb942a2..4800461bf 100644
--- a/quartz/cli/plugin-git-handlers.js
+++ b/quartz/cli/plugin-git-handlers.js
@@ -256,7 +256,10 @@ export async function handlePluginInstall() {
 
   if (!lockfile) {
     console.log(
-      styleText("yellow", "⚠ No quartz.lock.json found. Run 'npx quartz plugin add <repo>' first."),
+      styleText(
+        "yellow",
+        "⚠ No quartz.lock.json found. Run 'npx quartz plugin add <repo>' first.",
+      ),
     )
     return
   }
@@ -330,7 +333,7 @@ export async function handlePluginInstall() {
       try {
         console.log(styleText("cyan", `  → ${name}: cloning...`))
         const branchArg = entry.ref ? ` --branch ${entry.ref}` : ""
-        execSync(`git clone --depth 1${branchArg} ${entry.resolved} ${pluginDir}`, {
+        execSync(`git clone --depth 1${branchArg} "${entry.resolved}" "${pluginDir}"`, {
           stdio: "ignore",
         })
         if (entry.commit !== "unknown") {
@@ -421,9 +424,11 @@ export async function handlePluginAdd(sources) {
         console.log(styleText("cyan", `→ Adding ${name} from ${url}...`))
 
         if (ref) {
-          execSync(`git clone --depth 1 --branch ${ref} ${url} ${pluginDir}`, { stdio: "ignore" })
+          execSync(`git clone --depth 1 --branch ${ref} "${url}" "${pluginDir}"`, {
+            stdio: "ignore",
+          })
         } else {
-          execSync(`git clone --depth 1 ${url} ${pluginDir}`, { stdio: "ignore" })
+          execSync(`git clone --depth 1 "${url}" "${pluginDir}"`, { stdio: "ignore" })
         }
 
         const commit = getGitCommit(pluginDir)
@@ -659,7 +664,7 @@ export async function handlePluginCheck() {
 
     try {
       const lsRemoteRef = entry.ref ? `refs/heads/${entry.ref}` : "HEAD"
-      const latestCommit = execSync(`git ls-remote ${entry.resolved} ${lsRemoteRef}`, {
+      const latestCommit = execSync(`git ls-remote "${entry.resolved}" ${lsRemoteRef}`, {
         encoding: "utf-8",
       })
         .split("\t")[0]
@@ -880,7 +885,7 @@ export async function handlePluginRestore() {
         styleText("cyan", `→ ${name}: cloning ${entry.resolved}@${entry.commit.slice(0, 7)}...`),
       )
       const branchArg = entry.ref ? ` --branch ${entry.ref}` : ""
-      execSync(`git clone --depth 1${branchArg} ${entry.resolved} ${pluginDir}`, {
+      execSync(`git clone --depth 1${branchArg} "${entry.resolved}" "${pluginDir}"`, {
         stdio: "ignore",
       })
       execSync(`git checkout ${entry.commit}`, { cwd: pluginDir, stdio: "ignore" })
@@ -1080,9 +1085,11 @@ export async function handlePluginResolve({ dryRun = false } = {}) {
         console.log(styleText("cyan", `→ Cloning ${name} from ${url}...`))
 
         if (ref) {
-          execSync(`git clone --depth 1 --branch ${ref} ${url} ${pluginDir}`, { stdio: "ignore" })
+          execSync(`git clone --depth 1 --branch ${ref} "${url}" "${pluginDir}"`, {
+            stdio: "ignore",
+          })
         } else {
-          execSync(`git clone --depth 1 ${url} ${pluginDir}`, { stdio: "ignore" })
+          execSync(`git clone --depth 1 "${url}" "${pluginDir}"`, { stdio: "ignore" })
         }
 
         const commit = getGitCommit(pluginDir)