diff --git a/Makefile b/Makefile
index 1d142095a7..f13184b2ba 100644
--- a/Makefile
+++ b/Makefile
@@ -1210,9 +1210,12 @@ GIT-CFLAGS: .FORCE-GIT-CFLAGS
 		echo "$$FLAGS" >GIT-CFLAGS; \
             fi
 
+# We need to apply sq twice, once to protect from the shell
+# that runs GIT-BUILD-OPTIONS, and then again to protect it
+# and the first level quoting from the shell that runs "echo".
 GIT-BUILD-OPTIONS: .FORCE-GIT-BUILD-OPTIONS
-	@echo SHELL_PATH=\''$(SHELL_PATH_SQ)'\' >$@
-	@echo TAR=\''$(subst ','\'',$(TAR))'\' >>$@
+	@echo SHELL_PATH=\''$(subst ','\'',$(SHELL_PATH_SQ))'\' >$@
+	@echo TAR=\''$(subst ','\'',$(subst ','\'',$(TAR)))'\' >>$@
 
 ### Detect Tck/Tk interpreter path changes
 ifndef NO_TCLTK
diff --git a/t/t5000-tar-tree.sh b/t/t5000-tar-tree.sh
index 5eb119ed0b..87902f81ef 100755
--- a/t/t5000-tar-tree.sh
+++ b/t/t5000-tar-tree.sh
@@ -67,7 +67,7 @@ test_expect_success \
 test_expect_success \
     'validate file modification time' \
     'mkdir extract &&
-     $TAR xf b.tar -C extract a/a &&
+     "$TAR" xf b.tar -C extract a/a &&
      perl -e '\''print((stat("extract/a/a"))[9], "\n")'\'' >b.mtime &&
      echo "1117231200" >expected.mtime &&
      diff expected.mtime b.mtime'
@@ -79,7 +79,7 @@ test_expect_success \
 
 test_expect_success \
     'extract tar archive' \
-    '(cd b && $TAR xf -) <b.tar'
+    '(cd b && "$TAR" xf -) <b.tar'
 
 test_expect_success \
     'validate filenames' \
@@ -96,7 +96,7 @@ test_expect_success \
 
 test_expect_success \
     'extract tar archive with prefix' \
-    '(cd c && $TAR xf -) <c.tar'
+    '(cd c && "$TAR" xf -) <c.tar'
 
 test_expect_success \
     'validate filenames with prefix' \
@@ -116,7 +116,7 @@ test_expect_success \
 
 test_expect_success \
     'extract substfiles' \
-    '(mkdir f && cd f && $TAR xf -) <f.tar'
+    '(mkdir f && cd f && "$TAR" xf -) <f.tar'
 
 test_expect_success \
      'validate substfile contents' \
@@ -128,7 +128,7 @@ test_expect_success \
 
 test_expect_success \
     'extract substfiles from archive with prefix' \
-    '(mkdir g && cd g && $TAR xf -) <g.tar'
+    '(mkdir g && cd g && "$TAR" xf -) <g.tar'
 
 test_expect_success \
      'validate substfile contents from archive with prefix' \