diff --git a/setup.go b/deploy.go
similarity index 95%
rename from setup.go
rename to deploy.go
index 7f5afad..c685327 100644
--- a/setup.go
+++ b/deploy.go
@@ -380,7 +380,8 @@ systemctl restart pb@%s
 }
 
 func runSSHCommand(server, script string) error {
-	cmd := exec.Command("ssh", append(sshArgs(server), "bash", "--noprofile", "--norc", "-c", script)...)
+	remoteCmd := fmt.Sprintf("bash --noprofile --norc -c %s", shellQuote(script))
+	cmd := exec.Command("ssh", append(sshArgs(server), remoteCmd)...)
 	stdoutPipe, err := cmd.StdoutPipe()
 	if err != nil {
 		return err
@@ -404,7 +405,8 @@ func runSSHCommand(server, script string) error {
 }
 
 func runSSHOutput(server, script string) (string, error) {
-	cmd := exec.Command("ssh", append(sshArgs(server), "bash", "--noprofile", "--norc", "-c", script)...)
+	remoteCmd := fmt.Sprintf("bash --noprofile --norc -c %s", shellQuote(script))
+	cmd := exec.Command("ssh", append(sshArgs(server), remoteCmd)...)
 	var out bytes.Buffer
 	cmd.Stdout = &out
 	cmd.Stderr = os.Stderr
@@ -555,3 +557,20 @@ func isEnvLine(line string) bool {
 	}
 	return true
 }
+
+func shellQuote(value string) string {
+	if value == "" {
+		return "''"
+	}
+	var builder strings.Builder
+	builder.WriteByte('\'')
+	for _, r := range value {
+		if r == '\'' {
+			builder.WriteString("'\"'\"'")
+			continue
+		}
+		builder.WriteRune(r)
+	}
+	builder.WriteByte('\'')
+	return builder.String()
+}