diff --git a/nvm.sh b/nvm.sh
index 2c90e6bbd11..bcff8eee997 100644
--- a/nvm.sh
+++ b/nvm.sh
@@ -116,18 +116,17 @@ nvm_get_latest() {
 }
 
 nvm_download() {
-  local CURL_COMPRESSED_FLAG
-  local AUTH_HEADER_FLAG
+  if nvm_has "curl"; then
+    local CURL_OPTIONS=()
 
-  if [ -n "$NVM_AUTH_HEADER" ]; then
-    AUTH_HEADER_FLAG="--header $NVM_AUTH_HEADER"
-  fi
+    if [ -n "$NVM_AUTH_HEADER" ]; then
+      CURL_OPTIONS+=(--header "$NVM_AUTH_HEADER")
+    fi
 
-  if nvm_has "curl"; then
     if nvm_curl_use_compression; then
-      CURL_COMPRESSED_FLAG="--compressed"
+      CURL_OPTIONS+=(--compressed)
     fi
-    curl --fail ${CURL_COMPRESSED_FLAG:-} ${AUTH_HEADER_FLAG:-} -q "$@"
+    curl -q --fail "${CURL_OPTIONS[@]}" "$@"
   elif nvm_has "wget"; then
     # Emulate curl with wget
     ARGS=$(nvm_echo "$@" | command sed -e 's/--progress-bar /--progress=bar /' \
@@ -139,9 +138,9 @@ nvm_download() {
                             -e 's/-sS /-nv /' \
                             -e 's/-o /-O /' \
                             -e 's/-C - /-c /')
-                            
-    if [ -n "$AUTH_HEADER_FLAG" ]; then
-      ARGS="$AUTH_HEADER_FLAG $ARGS"
+
+    if [ -n "$NVM_AUTH_HEADER" ]; then
+      ARGS="$ARGS --header \"$NVM_AUTH_HEADER\""
     fi
     # shellcheck disable=SC2086
     eval wget $ARGS
diff --git a/test/fast/Unit tests/nvm_download b/test/fast/Unit tests/nvm_download
index 3afd76cc2df..53314c1e46a 100644
--- a/test/fast/Unit tests/nvm_download	
+++ b/test/fast/Unit tests/nvm_download	
@@ -15,4 +15,9 @@ nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/install.sh" >/de
 # nvm_download should fail to download wrong_install.sh
 ! nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/wrong_install.sh" >/dev/null || die "nvm_download should fail to download no existing file"
 
+# nvm_download should pass when calling with auth header
+NVM_AUTH_HEADER="Authorization: Bearer test-token"
+nvm_download "https://httpbin.org/bearer" >/dev/null || die "nvm_download unable to send auth header"
+unset NVM_AUTH_HEADER
+
 cleanup