diff --git a/letsencrypt/lib/common b/letsencrypt/lib/common
index cf34bce..a8c67a1 100644
--- a/letsencrypt/lib/common
+++ b/letsencrypt/lib/common
@@ -73,7 +73,7 @@ letsencrypt_get_challenge_type() {
     local domain="$1" renewal_file
     renewal_file="$SERVICE_DATASTORE"/etc/letsencrypt/renewal/"$domain".conf
     [ -e "$renewal_file" ] || return 1
-    grep '^pref_challs' "$renewal_file" | cut -f 2 -d "=" | xargs echo
+    grep '^pref_challs' "$renewal_file" | cut -f 2 -d "=" | nspc
 }
 
 letsencrypt_set_renew_before_expiry() {
diff --git a/postgres/hooks/schedule_command-relation-joined b/postgres/hooks/schedule_command-relation-joined
index 24d333f..fc15bc0 100755
--- a/postgres/hooks/schedule_command-relation-joined
+++ b/postgres/hooks/schedule_command-relation-joined
@@ -25,7 +25,8 @@ fi
 ##   is totally wanted: cron does not support multilines.
 
 exclude_dbs=$(relation-get exclude-dbs 2>/dev/null) || true
-exclude_dbs=$(echo "$exclude_dbs" | shyaml get-values 2>/dev/null | xargs echo) || true
+exclude_dbs=$(echo "$exclude_dbs" | shyaml get-values 2>/dev/null |
+                  nspc) || true
 
 ## Warning: 'docker -v' will use HOST directory even if launched from
 ##   'cron' container.