diff --git a/python/scripts/sd_nspawn.py b/python/scripts/sd_nspawn.py
index 8c0f09c6..0ba2599b 100755
--- a/python/scripts/sd_nspawn.py
+++ b/python/scripts/sd_nspawn.py
@@ -132,7 +132,7 @@ def _gen_cfg_str(self):
                         parts.append(f"{subkey}={' '.join(subval)}")
                     # All other list configurations should be joined with the key
                     else:
-                        parts += [f"{subkey}={item}" for item in subval]
+                        parts += [f"{subkey}={item}" for item in sorted(subval)]
                 elif subval:
                     parts.append(f"{subkey}={subval}")
             parts.append('')
@@ -183,7 +183,7 @@ def _gen_eph_cmd(self):
                     if flag == '--system-call-filter':
                         nspawn_cmd.append(f"{flag}={' '.join(value)}")
                     else:
-                        nspawn_cmd += [f"{flag}={item}" for item in value]
+                        nspawn_cmd += [f"{flag}={item}" for item in sorted(value)]
                 # certain configuration options are booleans but the commmand
                 # line option is just a simple flag
                 elif flag in ('--boot', ) and value == 'yes':