diff --git a/PREFIX.md b/PREFIX.md
index 1351e87e72..e353a0d5b6 100644
--- a/PREFIX.md
+++ b/PREFIX.md
@@ -17,7 +17,7 @@ Before prefix build support are considered stable, the below must be implemented
 ## About
 
 Prefix builds let you build and ship applications and all their dependencies in a custom directory.
-This custom directory is self-contained, all dependencies are included, and binaries are only linked agains libraries in the custom directory.
+This custom directory is self-contained, all dependencies are included, and binaries are only linked against libraries in the custom directory.
 The applications' root will be `/` - i.e. there's no need to `chroot` into the custom directory.
 
 For example, applications built with the prefix `/usr/local/my-app` will ship
diff --git a/build_library/prefix_util.sh b/build_library/prefix_util.sh
index dee1c72f2a..62a3adbdb6 100644
--- a/build_library/prefix_util.sh
+++ b/build_library/prefix_util.sh
@@ -4,7 +4,7 @@
 DEFAULT_STAGING_ROOT="/build/"
 
 function lineprepend() {
-  awk -v msg="$@" '{ print msg ": " $0}'
+  awk -v msg="$*" '{ print msg ": " $0}'
 }
 # --
 
@@ -114,17 +114,17 @@ function create_make_conf() {
 
 sudo_clobber "${filepath}" <<EOF
 DISTDIR="/mnt/host/source/.cache/distfiles"
-PKGDIR="${STAGINGDIR}/pkgs"
-PORT_LOGDIR="${dir}/logs"
-PORTAGE_TMPDIR="${dir}/tmp"
+PKGDIR=${STAGINGDIR@Q}/pkgs
+PORT_LOGDIR=${dir@Q}/logs
+PORTAGE_TMPDIR=${dir@Q}/tmp
 PORTAGE_BINHOST=""
 PORTAGE_USERNAME="sdk"
 MAKEOPTS="--jobs=4"
-CHOST="${PREFIX_CHOST}"
+CHOST=${PREFIX_CHOST@Q}
 
-ACCEPT_KEYWORDS="${PREFIX_KEYWORDS}"
+ACCEPT_KEYWORDS=${PREFIX_KEYWORDS@Q}
 
-EMERGE_DEFAULT_OPTS="${emerge_opts}"
+EMERGE_DEFAULT_OPTS=${emerge_opts@Q}
 
 USE="
 -desktop
@@ -162,11 +162,11 @@ function create_emerge_wrapper() {
 
 set -euo pipefail
 
-PREFIXNAME="${PREFIXNAME}"
-EPREFIX="${EPREFIX}"
-STAGINGROOT="${STAGINGROOT}"
-FINALROOT="${FINALROOT}"
-CB_ROOT="${CB_ROOT}"
+PREFIXNAME=${PREFIXNAME@Q}
+EPREFIX=${EPREFIX@Q}
+STAGINGROOT=${STAGINGROOT@Q}
+FINALROOT=${FINALROOT@Q}
+CB_ROOT=${CB_ROOT@Q}
 
 if [ "\${1}" = "--help" ] ; then
     echo "\$0 : emerge prefix wrapper for prefix '\${PREFIXNAME}'"
@@ -178,11 +178,11 @@ if [ "\${1}" = "--help" ] ; then
     echo "             --install    Skip build, just install. Binpkg must exist in staging."
     echo
     echo "      Prefix configuration:"
-    echo "        PREFIXNAME=\"\${PREFIXNAME}\""
-    echo "        EPREFIX=\"\${EPREFIX}\""
-    echo "        STAGINGROOT=\"\${STAGINGROOT}\""
-    echo "        FINALROOT=\"\${FINALROOT}\""
-    echo "        CB_ROOT="\${CB_ROOT}""
+    echo "        PREFIXNAME=\${PREFIXNAME@Q}"
+    echo "        EPREFIX=\${EPREFIX@Q}"
+    echo "        STAGINGROOT=\${STAGINGROOT@Q}"
+    echo "        FINALROOT=\${FINALROOT@Q}"
+    echo "        CB_ROOT=\${CB_ROOT@Q}"
     exit
 fi
 
@@ -199,7 +199,7 @@ if [ "\${skip_build}" = "true" ]  ; then
     echo "NOTE that install into final will fail if binpkgs are missing."
 else
     echo "Building in staging..."
-    sudo -E EPREFIX=\${EPREFIX} \${CB_ROOT}/bin/cb-emerge \${STAGINGROOT} "\$@"
+    sudo -E EPREFIX="\${EPREFIX}" "\${CB_ROOT}/bin/cb-emerge" "\${STAGINGROOT}" "\$@"
 fi
 
 if [ "\${skip_install}" = "true" ]  ; then
diff --git a/sdk_container/src/third_party/prefix-overlay/prefix/prefix-final/prefix-final-0.0.1.ebuild b/sdk_container/src/third_party/prefix-overlay/prefix/prefix-final/prefix-final-0.0.1.ebuild
index 1053c8abc3..e3cd428c25 100644
--- a/sdk_container/src/third_party/prefix-overlay/prefix/prefix-final/prefix-final-0.0.1.ebuild
+++ b/sdk_container/src/third_party/prefix-overlay/prefix/prefix-final/prefix-final-0.0.1.ebuild
@@ -11,6 +11,6 @@ KEYWORDS="amd64 arm64"
 
 # These should be the absolute minimum runtime dependencies of the "final" prefix.
 # "Staging" has @system so it is pretty heavyweight.
-RDEPEND="${RDEPEND}
+RDEPEND="
     virtual/libc
 "