diff --git a/internal/command/action.go b/internal/command/action.go
index be9e006..6b851bc 100644
--- a/internal/command/action.go
+++ b/internal/command/action.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"sync"
 	"syscall"
@@ -198,7 +199,12 @@ func formatForEnv(key string, value string, spec secretsyml.SecretSpec, tempFact
 func joinEnv(env map[string]string) string {
 	var envs []string
 	for k, v := range env {
-		envs = append(envs, fmt.Sprintf("%s=%s", k, v))
+		if strings.Contains(v, "\n") {
+			keyEq := []byte(fmt.Sprintf("%s=", k))
+			envs = append(envs, string(strconv.AppendQuote(keyEq, v)))
+		} else {
+			envs = append(envs, fmt.Sprintf("%s=%s", k, v))
+		}
 	}
 	return strings.Join(envs, "\n") + "\n"
 }
diff --git a/internal/command/action_test.go b/internal/command/action_test.go
index 5ec4986..e03e707 100644
--- a/internal/command/action_test.go
+++ b/internal/command/action_test.go
@@ -81,8 +81,8 @@ func TestFormatForEnvString(t *testing.T) {
 
 func TestJoinEnv(t *testing.T) {
 	Convey("adds a trailing newline", t, func() {
-		result := joinEnv(map[string]string{"foo": "bar", "baz": "qux"})
-		So(result, ShouldEqual, "foo=bar\nbaz=qux\n")
+		result := joinEnv(map[string]string{"foo": "bar\nfoo", "baz": "qux"})
+		So(result, ShouldEqual, "foo=\"bar\\nfoo\"\nbaz=qux\n")
 	})
 }