diff --git a/cmake/QtPublicSbomGenerationHelpers.cmake b/cmake/QtPublicSbomGenerationHelpers.cmake
index 42d8a7ab45f..bcd16b1e812 100644
--- a/cmake/QtPublicSbomGenerationHelpers.cmake
+++ b/cmake/QtPublicSbomGenerationHelpers.cmake
@@ -703,7 +703,7 @@ FileCopyrightText: NOASSERTION"
     endif()
 
     set(content "
-        if(NOT EXISTS \$ENV{DESTDIR}${install_prefix}/${arg_FILENAME}
+        if(NOT EXISTS \"\$ENV{DESTDIR}${install_prefix}/${arg_FILENAME}\"
                 AND NOT QT_SBOM_BUILD_TIME AND NOT QT_SBOM_FAKE_CHECKSUM)
             if(NOT ${arg_OPTIONAL})
                 message(FATAL_ERROR \"Cannot find '${arg_FILENAME}' to compute its checksum. \"
@@ -714,7 +714,7 @@ FileCopyrightText: NOASSERTION"
                 if(QT_SBOM_FAKE_CHECKSUM)
                     set(sha1 \"158942a783ee1095eafacaffd93de73edeadbeef\")
                 else()
-                    file(SHA1 \$ENV{DESTDIR}${install_prefix}/${arg_FILENAME} sha1)
+                    file(SHA1 \"\$ENV{DESTDIR}${install_prefix}/${arg_FILENAME}\" sha1)
                 endif()
                 list(APPEND QT_SBOM_VERIFICATION_CODES \${sha1})
             endif()