diff --git a/src/PHP/ComposerRequire.php b/src/PHP/ComposerRequire.php
index 5eeaca9..fcf69b8 100644
--- a/src/PHP/ComposerRequire.php
+++ b/src/PHP/ComposerRequire.php
@@ -20,6 +20,6 @@ public function __toString(): string
         return (string) new Dockerfile\Run(sprintf(<<<'RUN'
             set -ex \
                 && composer require --prefer-dist --no-progress --prefer-stable --sort-packages --optimize-autoloader --with-dependencies %s
-            RUN, implode(' ', $this->packages)));
+            RUN, implode(' ', array_map(fn (string $package) => escapeshellarg($package), $this->packages))));
     }
 }