{ config, lib, ... }: {
  options.hrm.environment.variables = lib.mkOption {
    type = lib.types.attrsOf lib.types.str;
    default = {};
    description = ''
      This is a stricter version of `environment.variables`, using
      `escapeShellArg` instead of `"` for quoting.

      Use this when you don't have the need to reference other variables or
      inject code into `/nix/store/*-set-environment`.  This is also useful
      for variables that need be used in contexts that don't perform shell
      initialization, like e.g. `systemd.services.*.environment`;
    '';
  };
  config.environment.variables =
    lib.mapAttrs
      (_name: value: ''"${lib.escapeShellArg value}"'')
      config.hrm.environment.variables;
}