diff --git a/git-credential-s3-secrets b/git-credential-s3-secrets
index d2e19e4..0e9cc7d 100755
--- a/git-credential-s3-secrets
+++ b/git-credential-s3-secrets
@@ -60,10 +60,10 @@ s3_bucket_region() {
   then
     # This plug-in may not be executing in an AWS VPC or have access to the IDMS
     # Fail fast with the --connect-timeout flag
-    local token=$(curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" --fail --silent --show-error --location --connect-timeout 5 http://169.254.169.254/latest/api/token)
+    local token=$(curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" --fail --silent --show-error --location --connect-timeout 5 "http://169.254.169.254/latest/api/token")
     if [ -n "${token}" ]
     then
-      guess_region=$(curl -H "X-aws-ec2-metadata-token: $token" --fail --silent --show-error --location http://169.254.169.254/latest/meta-data/placement/region)
+      guess_region=$(curl -H "X-aws-ec2-metadata-token: $token" --fail --silent --show-error --location "http://169.254.169.254/latest/meta-data/placement/region")
     fi
   fi
   if [ -z "${guess_region}" ]