diff --git a/local/propose-patches.R b/local/propose-patches.R
index 11085f0..7008251 100644
--- a/local/propose-patches.R
+++ b/local/propose-patches.R
@@ -435,7 +435,9 @@ if (do_write) {
   save_ledger(merge_ledger(load_ledger(), new_ledger_records))
 
   git <- function(...) {
-    st <- system2("git", c(...), stdout = TRUE, stderr = TRUE)
+    # system2() with captured output runs via /bin/sh, so shell-quote every arg
+    # (commit messages contain "()", refs contain "^{}", etc.).
+    st <- system2("git", shQuote(c(...)), stdout = TRUE, stderr = TRUE)
     if (!identical(attr(st, "status"), NULL)) {
       stop(sprintf(
         "git %s failed:\n%s",
diff --git a/local/trial-build-registry.R b/local/trial-build-registry.R
index f649b62..0749bf7 100644
--- a/local/trial-build-registry.R
+++ b/local/trial-build-registry.R
@@ -52,9 +52,16 @@ current <- if (file.exists(registry_file)) {
 # silently treating the base as empty would trial-build the WHOLE registry
 # instead of just the entries the branch adds.
 registry_rel <- "local/patches/registry.json"
+# system2() with captured output runs via /bin/sh, so shell-quote the git args
+# (refs contain "^{}" and ":" that the shell would otherwise mangle).
 ref_ok <- suppressWarnings(system2(
   "git",
-  c("rev-parse", "--verify", "--quiet", sprintf("%s^{commit}", base_ref)),
+  shQuote(c(
+    "rev-parse",
+    "--verify",
+    "--quiet",
+    sprintf("%s^{commit}", base_ref)
+  )),
   stdout = TRUE,
   stderr = FALSE
 ))
@@ -63,14 +70,14 @@ if (!is.null(attr(ref_ok, "status"))) {
 }
 in_base <- suppressWarnings(system2(
   "git",
-  c("ls-tree", base_ref, "--", registry_rel),
+  shQuote(c("ls-tree", base_ref, "--", registry_rel)),
   stdout = TRUE,
   stderr = FALSE
 ))
 file_in_base <- length(in_base) > 0L && any(nzchar(in_base))
 base_json <- suppressWarnings(system2(
   "git",
-  c("show", sprintf("%s:%s", base_ref, registry_rel)),
+  shQuote(c("show", sprintf("%s:%s", base_ref, registry_rel))),
   stdout = TRUE,
   stderr = FALSE
 ))