diff --git a/modules/programs/mbsync.nix b/modules/programs/mbsync.nix
index d43f64555..8694d2007 100644
--- a/modules/programs/mbsync.nix
+++ b/modules/programs/mbsync.nix
@@ -84,7 +84,7 @@ let
     genSection "IMAPAccount ${name}" ({
       Host = imap.host;
       User = userName;
-      PassCmd = toString passwordCommand;
+      PassCmd = lib.escapeShellArgs passwordCommand;
     } // genTlsConfig imap.tls
       // optionalAttrs (imap.port != null) { Port = toString imap.port; }
       // mbsync.extraConfig.account) + "\n"
diff --git a/tests/modules/programs/mbsync/mbsync-expected.conf b/tests/modules/programs/mbsync/mbsync-expected.conf
index 171109782..b6c77ea1c 100644
--- a/tests/modules/programs/mbsync/mbsync-expected.conf
+++ b/tests/modules/programs/mbsync/mbsync-expected.conf
@@ -3,7 +3,7 @@
 IMAPAccount hm-account
 CertificateFile /etc/ssl/certs/ca-certificates.crt
 Host imap.example.org
-PassCmd "password-command 2"
+PassCmd "'password-command' '2'"
 SSLType IMAPS
 User home.manager.jr
 
@@ -55,7 +55,7 @@ Channel hm-account-strangeHostBoxName
 IMAPAccount hm@example.com
 CertificateFile /etc/ssl/certs/ca-certificates.crt
 Host imap.example.com
-PassCmd password-command
+PassCmd 'password-command'
 SSLType IMAPS
 SSLVersions TLSv1.3 TLSv1.2
 User home.manager