diff --git a/lib/manager/gradle-wrapper/artifacts.ts b/lib/manager/gradle-wrapper/artifacts.ts
index d594c16ad8e2783d6c136a32602f1aadfa7c5c69..3dda4a837c9f89bca827a3100e285634f54e951a 100644
--- a/lib/manager/gradle-wrapper/artifacts.ts
+++ b/lib/manager/gradle-wrapper/artifacts.ts
@@ -1,3 +1,4 @@
+import { quote } from 'shlex';
 import { resolve } from 'upath';
 import { getGlobalConfig } from '../../config/global';
 import { TEMPORARY_ERROR } from '../../constants/error-messages';
@@ -80,10 +81,10 @@ export async function updateArtifacts({
           newPackageFileContent.replace(config.newValue, config.currentValue)
         );
         const checksum = await getDistributionChecksum(distributionUrl);
-        cmd += ` --gradle-distribution-sha256-sum ${checksum}`;
+        cmd += ` --gradle-distribution-sha256-sum ${quote(checksum)}`;
       }
     } else {
-      cmd += ` --gradle-version ${config.newValue}`;
+      cmd += ` --gradle-version ${quote(config.newValue)}`;
     }
     logger.debug(`Updating gradle wrapper: "${cmd}"`);
     const execOptions: ExecOptions = {