diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 69ebd9f3..60fc750e 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -352,13 +352,17 @@ fn agent_flake_ref(name: &str) -> String {
     format!("{META_DIR}#{name}")
 }
 
-/// Validate one nspawn flag entry: must be non-empty and contain no
-/// ASCII whitespace or null bytes. Whitespace would split the entry
-/// into multiple flags when the start script expands
-/// `$EXTRA_NSPAWN_FLAGS` unquoted.
+/// Validate one nspawn flag entry. Must be non-empty and contain no
+/// ASCII whitespace (would split the entry when the start script
+/// expands `$EXTRA_NSPAWN_FLAGS` unquoted), double-quotes (would
+/// break the `EXTRA_NSPAWN_FLAGS="..."` conf line), or null bytes.
 fn validate_nspawn_flag(flag: &str) -> Result<()> {
-    if flag.is_empty() || flag.bytes().any(|b| b == 0 || b.is_ascii_whitespace()) {
-        bail!("invalid nspawn flag {flag:?}: must be non-empty and contain no whitespace or null bytes");
+    if flag.is_empty()
+        || flag.bytes().any(|b| b == 0 || b == b'"' || b.is_ascii_whitespace())
+    {
+        bail!(
+            "invalid nspawn flag {flag:?}: must be non-empty and contain no whitespace, double-quotes, or null bytes"
+        );
     }
     Ok(())
 }