diff --git a/bootstrap.py b/bootstrap.py
index b41e32b..5710bbb 100644
--- a/bootstrap.py
+++ b/bootstrap.py
@@ -18,6 +18,7 @@
 
 import os
 import platform
+import shlex
 import shutil
 import subprocess
 import sys
@@ -81,9 +82,9 @@ def run_cmd(cmd, description=None):
     if description:
         print(f"  → {description}")
     try:
+        args = cmd if isinstance(cmd, list) else shlex.split(cmd)
         result = subprocess.run(
-            cmd,
-            shell=True,
+            args,
             check=True,
             capture_output=True,
             text=True,