diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 44ac80737bc07..ae6c372208e12 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -109,7 +109,7 @@ tryHashedMirrors() {
 set -o noglob
 
 urls2=
-for url in $urls; do
+for url in "${urls[@]}"; do
     if test "${url:0:9}" != "mirror://"; then
         urls2="$urls2 $url"
     else