diff --git a/README.md b/README.md
index e6158fa..117815a 100644
--- a/README.md
+++ b/README.md
@@ -73,7 +73,7 @@ Here are the full list of inputs and outputs; below we describe what exactly is
 | `path` | No | Path to the application directory within the repository. Defaults to the repository root. Use this when your app lives in a subdirectory of your repo. |
 | `draft` | No | Deploy as a draft (preview) bundle instead of activating it. Defaults to `true` on `pull_request` events and `false` otherwise. Set it explicitly to override--e.g. `false` to publish directly from a PR, or `true` to stage a draft from a push. |
 | `github-token` | No | GitHub token for commenting preview URLs on PRs |
-| `rsconnect-args` | No | Additional arguments passed to `rsconnect deploy` |
+| `rsconnect-args` | No | Additional arguments passed to `rsconnect deploy`. |
 
 #### Outputs
 
diff --git a/deploy/scripts/deploy.sh b/deploy/scripts/deploy.sh
index c040d7a..68dab8f 100755
--- a/deploy/scripts/deploy.sh
+++ b/deploy/scripts/deploy.sh
@@ -5,7 +5,7 @@
 # Required env vars: CONTENT_GUID, APP_TYPE (resolved by the "Determine app type"
 #   step: a `posit connect deploy` subcommand, or "manifest")
 # Optional env vars: CONFIG_ENTRYPOINT, EXTRA_FILES, DRAFT, GITHUB_EVENT_NAME,
-#   RSCONNECT_ARGS
+#   RSCONNECT_ARGS (raw rsconnect-args input, parsed with shlex for shell quoting)
 
 set -euo pipefail
 
@@ -99,8 +99,21 @@ if [ "${SEND_METADATA:-true}" = "true" ]; then
   fi
 fi
 
-# shellcheck disable=SC2086
-posit connect deploy "$APP_TYPE" "${DRAFT_ARGS[@]}" --app-id "$CONTENT_GUID" "${ENTRYPOINT_ARGS[@]}" "${METADATA_ARGS[@]}" ${RSCONNECT_ARGS:-} "$DEPLOY_TARGET" "${EXTRA_FILE_ARGS[@]}" 2>&1 | tee deploy.log
+RSCONNECT_ARGS_ARR=()
+if [ -n "${RSCONNECT_ARGS:-}" ]; then
+  while IFS= read -r rsconnect_arg; do
+    [ -n "$rsconnect_arg" ] && RSCONNECT_ARGS_ARR+=("$rsconnect_arg")
+  done < <(python3 -c "
+import shlex, sys
+try:
+    print('\n'.join(shlex.split(sys.argv[1])))
+except ValueError as e:
+    print(f'Error: Could not parse rsconnect-args: {e}', file=sys.stderr)
+    sys.exit(1)
+" "$RSCONNECT_ARGS")
+fi
+
+posit connect deploy "$APP_TYPE" "${DRAFT_ARGS[@]}" --app-id "$CONTENT_GUID" "${ENTRYPOINT_ARGS[@]}" "${METADATA_ARGS[@]}" "${RSCONNECT_ARGS_ARR[@]}" "$DEPLOY_TARGET" "${EXTRA_FILE_ARGS[@]}" 2>&1 | tee deploy.log
 
 # Extract URL from logs, stripping ANSI color codes
 CONTENT_URL=$(grep "$URL_PATTERN" deploy.log | sed "s/.*$URL_PATTERN //" | sed 's/\x1b\[[0-9;]*m//g')