diff --git a/ucore/install-ucore.sh b/ucore/install-ucore.sh
index 9f5e3c9..cfe6a43 100755
--- a/ucore/install-ucore.sh
+++ b/ucore/install-ucore.sh
@@ -21,7 +21,7 @@ curl --fail --retry 5 --retry-delay 5 --retry-all-errors -sSL -o /tmp/mfs-api.js
 MFS_TGZ_URL=$(cat /tmp/mfs-api.json | \
     jq -r --arg arch_filter "linux_amd64" \
     '.assets | sort_by(.created_at) | reverse | .[] | select(.name|test($arch_filter)) | select (.name|test("tar.gz$")) | .browser_download_url')
-curl -sSL -o /tmp/mergerfs.tar.gz ${MFS_TGZ_URL}
+curl -sSL -o /tmp/mergerfs.tar.gz "${MFS_TGZ_URL}"
 tar -zxvf /tmp/mergerfs.tar.gz -C /usr --strip-components=2
 
 # tweak os-release