diff --git a/lenverge.sh b/lenverge.sh
old mode 100644
new mode 100755
index 45d6551..e59eb2c
--- a/lenverge.sh
+++ b/lenverge.sh
@@ -6,7 +6,7 @@
 
 # Find the script's own directory to run from the correct location,
 # ensuring that playbook.yml and other files are found.
-chmod +x /home/$(whoami)
+chmod +x "/home/$(whoami)"
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 cd "$SCRIPT_DIR"
 
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index fdb19ff..29b6c98 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -24,7 +24,7 @@
 
 - name: "Set is_wsl fact based on /proc/version content"
   ansible.builtin.set_fact:
-    is_wsl: "'Microsoft' in (lookup('file', '/proc/version') | default(''))"
+    is_wsl: "{{ 'Microsoft' in (lookup('file', '/proc/version') | default('')) }}"
   when: proc_version_stat.stat.exists
 
 - name: "Ensure correct automount options are set in /etc/wsl.conf"
@@ -40,7 +40,7 @@
       enabled = true
       options = "metadata,uid={{ ansible_user_uid }},gid={{ ansible_user_gid }},umask=22,fmask=11"
       [user]
-      default = {{ ansible_env.SUDO_USER | default(ansible_user_id) }}
+      default = "{{ ansible_env.SUDO_USER | default(ansible_user_id) }}"
   register: wsl_conf_result
   when: is_wsl | default(false)
 
diff --git a/roles/projects/templates/nginx-site.conf.j2 b/roles/projects/templates/nginx-site.conf.j2
index 9483319..68e0cb9 100644
--- a/roles/projects/templates/nginx-site.conf.j2
+++ b/roles/projects/templates/nginx-site.conf.j2
@@ -2,7 +2,7 @@ server {
     listen 80;
     server_name {{ project.domain }};
 
-    root {{ project.document_root }};
+    root "{{ project.document_root }}";
     index index.php;
 
     access_log /var/log/nginx/{{ project.domain }}-access.log;