diff --git a/lib/manager/bundler/artifacts.ts b/lib/manager/bundler/artifacts.ts
index 87e3c9b5e94b02f851a08cda326cb2c0d387dc62..4fec0c0f759b3e2034ca302c3c3760cd0f7e176e 100644
--- a/lib/manager/bundler/artifacts.ts
+++ b/lib/manager/bundler/artifacts.ts
@@ -1,3 +1,4 @@
+import { quote } from 'shlex';
 import { BUNDLER_INVALID_CREDENTIALS } from '../../constants/error-messages';
 import { logger } from '../../logger';
 import { platform } from '../../platform';
@@ -97,7 +98,7 @@ export async function updateArtifacts(
     if (config.isLockFileMaintenance) {
       cmd = 'bundle lock';
     } else {
-      cmd = `bundle lock --update ${updatedDeps.join(' ')}`;
+      cmd = `bundle lock --update ${updatedDeps.map(quote).join(' ')}`;
     }
 
     let bundlerVersion = '';
@@ -105,7 +106,7 @@ export async function updateArtifacts(
     if (bundler) {
       if (isValid(bundler)) {
         logger.debug({ bundlerVersion: bundler }, 'Found bundler version');
-        bundlerVersion = ` -v ${bundler}`;
+        bundlerVersion = ` -v ${quote(bundler)}`;
       } else {
         logger.warn({ bundlerVersion: bundler }, 'Invalid bundler version');
       }