diff --git a/example/f2fs.nix b/example/f2fs.nix
index f5a1e8f2..838b1a13 100644
--- a/example/f2fs.nix
+++ b/example/f2fs.nix
@@ -23,6 +23,13 @@
                 type = "filesystem";
                 format = "f2fs";
                 mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
               };
             };
           };
@@ -31,4 +38,3 @@
     };
   };
 }
-
diff --git a/example/zfs-with-vdevs.nix b/example/zfs-with-vdevs.nix
index a61680a6..96750fd8 100644
--- a/example/zfs-with-vdevs.nix
+++ b/example/zfs-with-vdevs.nix
@@ -93,6 +93,8 @@
             cache = [ "cache" ];
           };
         };
+        # Workaround: cannot import 'zroot': I/O error in disko tests
+        options.cachefile = "none";
 
         rootFsOptions = {
           compression = "zstd";
diff --git a/lib/default.nix b/lib/default.nix
index ccf169a8..0506983e 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -261,7 +261,9 @@ let
       interpreter = if noDeps then "/usr/bin/env bash" else "${pkgs.bash}/bin/bash";
       check = lib.optionalString (checked && !pkgs.hostPlatform.isRiscV64 && !pkgs.hostPlatform.isx86_32) (pkgs.writeScript "check" ''
         set -efu
-        ${pkgs.shellcheck}/bin/shellcheck -e SC2034 "$1"
+        # SC2054: our toShellVars function doesn't quote list elements with commas
+        # SC2034: We don't use all variables exported by hooks.
+        ${pkgs.shellcheck}/bin/shellcheck -e SC2034,SC2054 "$1"
       '');
     };
 
diff --git a/lib/types/filesystem.nix b/lib/types/filesystem.nix
index 8f9e80d0..5327e7ad 100644
--- a/lib/types/filesystem.nix
+++ b/lib/types/filesystem.nix
@@ -46,7 +46,7 @@
       default = ''
         if ! (blkid '${config.device}' | grep -q 'TYPE='); then
           mkfs.${config.format} \
-            ${toString config.extraArgs} \
+            ${lib.escapeShellArgs config.extraArgs} \
             ${config.device}
         fi
       '';
@@ -58,7 +58,7 @@
           if ! findmnt ${config.device} "${rootMountPoint}${config.mountpoint}" >/dev/null 2>&1; then
             mount ${config.device} "${rootMountPoint}${config.mountpoint}" \
               -t "${config.format}" \
-              ${lib.concatMapStringsSep " " (opt: "-o ${opt}") config.mountOptions} \
+              ${lib.concatMapStringsSep " " (opt: "-o ${lib.escapeShellArg opt}") config.mountOptions} \
               -o X-mount.mkdir
           fi
         '';