diff --git a/ci/vmtest/run_selftests.sh b/ci/vmtest/run_selftests.sh
index 1dcde76..f7222c0 100755
--- a/ci/vmtest/run_selftests.sh
+++ b/ci/vmtest/run_selftests.sh
@@ -13,7 +13,7 @@ read_lists() {
 		if [[ -s "$path" ]]; then
 			cat "$path"
 		fi;
-	done) | cut -d'#' -f1 | tr -s ' \t\n' ','
+	done) | cut -d'#' -f1 | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' | tr -s '\n' ','
 }
 
 test_progs() {
@@ -22,7 +22,7 @@ test_progs() {
 		# "&& true" does not change the return code (it is not executed
 		# if the Python script fails), but it prevents exiting on a
 		# failure due to the "set -e".
-		./test_progs ${DENYLIST:+-d$DENYLIST} ${ALLOWLIST:+-a$ALLOWLIST} && true
+		./test_progs ${DENYLIST:+-d"$DENYLIST"} ${ALLOWLIST:+-a"$ALLOWLIST"} && true
 		echo "test_progs:$?" >> "${STATUS_FILE}"
 		foldable end test_progs
 	fi
@@ -30,7 +30,7 @@ test_progs() {
 
 test_progs_no_alu32() {
 	foldable start test_progs-no_alu32 "Testing test_progs-no_alu32"
-	./test_progs-no_alu32 ${DENYLIST:+-d$DENYLIST} ${ALLOWLIST:+-a$ALLOWLIST} && true
+	./test_progs-no_alu32 ${DENYLIST:+-d"$DENYLIST"} ${ALLOWLIST:+-a"$ALLOWLIST"} && true
 	echo "test_progs-no_alu32:$?" >> "${STATUS_FILE}"
 	foldable end test_progs-no_alu32
 }