diff --git a/.cirrus.yml b/.cirrus.yml
index 1ea8d4e68..3f66e7330 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -219,7 +219,7 @@ macos_task_template: &MACOS_TASK_TEMPLATE
     - rm $HOME/DeveloperIDG2CA.cer
     - rm certificate.p12
     # Set the partition list (sort of like an access control list)
-    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+    - security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
     # Echo the identity, just so that we know it worked.
     # This won't display anything secret.
     - security find-identity -v -p codesigning
diff --git a/appveyor.yml b/appveyor.yml
index dba3de3ac..4610c8e85 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -641,7 +641,7 @@ for:
     - rm $HOME/DeveloperIDG2CA.cer
     - rm certificate.p12
     # Set the partition list (sort of like an access control list)
-    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+    - security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
     # Echo the identity, just so that we know it worked.
     # This won't display anything secret.
     - security find-identity -v -p codesigning
@@ -809,7 +809,7 @@ for:
     - rm $HOME/DeveloperIDG2CA.cer
     - rm certificate.p12
     # Set the partition list (sort of like an access control list)
-    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+    - security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
     # Echo the identity, just so that we know it worked.
     # This won't display anything secret.
     - security find-identity -v -p codesigning