diff --git a/Cargo.lock b/Cargo.lock
index 0140616a5..25a7443e3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1160,7 +1160,7 @@ dependencies = [
  "quote",
  "regex",
  "rustc-hash 2.1.2",
- "shlex",
+ "shlex 1.3.0",
  "syn 2.0.117",
 ]
 
@@ -1932,7 +1932,7 @@ dependencies = [
  "find-msvc-tools",
  "jobserver",
  "libc",
- "shlex",
+ "shlex 1.3.0",
 ]
 
 [[package]]
@@ -4700,7 +4700,7 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "sha2 0.11.0",
- "shlex",
+ "shlex 2.0.1",
  "sigstore-verify",
  "strum 0.28.0",
  "tar",
@@ -7316,7 +7316,7 @@ dependencies = [
  "rmcp",
  "serde",
  "serde_json",
- "shlex",
+ "shlex 1.3.0",
  "thiserror 2.0.18",
  "tokio",
  "tonic",
@@ -9168,6 +9168,12 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
diff --git a/crates/goose-cli/Cargo.toml b/crates/goose-cli/Cargo.toml
index 2f33e21b1..417496b74 100644
--- a/crates/goose-cli/Cargo.toml
+++ b/crates/goose-cli/Cargo.toml
@@ -44,7 +44,7 @@ rustyline = { version = "18", default-features = false, features = ["custom-bind
 tracing = { workspace = true }
 chrono = { workspace = true }
 tracing-subscriber = { workspace = true, features = ["env-filter", "fmt", "json", "time"] }
-shlex = { version = "1.3", default-features = false, features = ["std"] }
+shlex = { version = "2.0", default-features = false, features = ["std"] }
 async-trait = { workspace = true }
 base64 = { workspace = true }
 regex = { workspace = true }