diff --git a/docker/mosquitto/gen-passwd.sh b/docker/mosquitto/gen-passwd.sh
index aef4cd7..a373e14 100755
--- a/docker/mosquitto/gen-passwd.sh
+++ b/docker/mosquitto/gen-passwd.sh
@@ -24,11 +24,18 @@ LPASS="$(ensure_pw MQTT_AUTH_PASSWORD)"
 SPASS="$(ensure_pw MQTT_SHELLY_PASSWORD)"
 DPASS="$(ensure_pw MQTT_SIDECAR_PASSWORD)"
 
-docker run --rm -v "$(pwd)/docker/mosquitto/config:/cfg" eclipse-mosquitto:2 sh -c "
-    rm -f /cfg/passwd
-    mosquitto_passwd -c -b /cfg/passwd laravel '${LPASS}'
-    mosquitto_passwd -b /cfg/passwd shelly  '${SPASS}'
-    mosquitto_passwd -b /cfg/passwd sidecar '${DPASS}'
-    chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
-"
+# Export + forward with bare `-e NAME` so docker passes the values verbatim (no host
+# interpolation). Read inside the container (single-quoted body) as env vars, so any
+# character in a password — quotes, $, ;, backticks — is handled safely.
+export LPASS SPASS DPASS
+
+docker run --rm -e LPASS -e SPASS -e DPASS \
+    -v "$(pwd)/docker/mosquitto/config:/cfg" \
+    eclipse-mosquitto:2 sh -c '
+        rm -f /cfg/passwd
+        mosquitto_passwd -c -b /cfg/passwd laravel "$LPASS"
+        mosquitto_passwd -b /cfg/passwd shelly  "$SPASS"
+        mosquitto_passwd -b /cfg/passwd sidecar "$DPASS"
+        chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
+    '
 echo 'Mosquitto passwd generated (users: laravel, shelly, sidecar).'