diff --git a/src/prefab/construct-env.test.ts b/src/prefab/construct-env.test.ts
index 863d4680..f4c12f43 100644
--- a/src/prefab/construct-env.test.ts
+++ b/src/prefab/construct-env.test.ts
@@ -27,7 +27,7 @@ Deno.test("construct_env.ts", async runner => {
     try {
       const rv = await specimen({ installations })
       assertEquals(rv['FOO_FLAGS'], "bar bar bar bar ${FOO_FLAGS} baz${FOO_FLAGS} baz${FOO_FLAGS} baz${FOO_FLAGS} baz") //FIXME lol
-      assertEquals(rv['PATH'], `/opt/bin:${tmp.join('foo/v2.3.4/bin')}:\${PATH}`)
+      assertEquals(rv['PATH'], `/opt/bin:${tmp.join('foo/v2.3.4/bin')}\${PATH:+:$PATH}`)
     } finally {
       stub2.restore()
       tmp.rm({recursive: true})
diff --git a/src/prefab/construct-env.ts b/src/prefab/construct-env.ts
index 76da15fc..0cf22dcd 100644
--- a/src/prefab/construct-env.ts
+++ b/src/prefab/construct-env.ts
@@ -24,6 +24,10 @@ export default async function(pkgenv: { installations: Installation[] }) {
 
   for (const key in rv) {
     rv[key] = rv[key].replaceAll(new RegExp(`\\$${key}\\b`, 'g'), `\${${key}}`)
+    // don’t end with a trailing `:` since that is sometimes interpreted as CWD and can break things
+    // instead of `foo:${PATH}` we end up with `foo${PATH:+:PATH}` which is not POSIX but works
+    // with all realy shells to avoid the trailing `:`
+    rv[key] = rv[key].replaceAll(new RegExp(`:+\\$\{${key}}$`, 'g'), `\${${key}:+:$${key}}`)
   }
 
   return rv