diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index c89d86d..b56ff89 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -2507,6 +2507,7 @@ cjc.mainProgram(args)
 - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
 - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
 - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
+- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
 
 * Mon Jul  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
 - Update to jdk-17.0.12+6 (EA)
diff --git a/scripts/generate_source_tarball.sh b/scripts/generate_source_tarball.sh
index d9d030f..9281589 100755
--- a/scripts/generate_source_tarball.sh
+++ b/scripts/generate_source_tarball.sh
@@ -225,7 +225,7 @@ else
             DEPTH="--depth=1";
             echo "Remote repository detected; adding ${DEPTH}";
         fi
-        git clone ${DEPTH} -b "${VERSION}" "${REPO_ROOT}" "${VERSION}"
+        git clone "${DEPTH}" -b "${VERSION}" "${REPO_ROOT}" "${VERSION}"
         pushd "${VERSION}"
             TAR_TIME="$(git log --max-count 1 --format=%cI)"
         popd