diff --git a/manifests/server/instance/passwd.pp b/manifests/server/instance/passwd.pp
index a4bc20f467..af556af3dd 100644
--- a/manifests/server/instance/passwd.pp
+++ b/manifests/server/instance/passwd.pp
@@ -60,7 +60,7 @@
       # environment variable. If the password is correct (current), this
       # command will exit with an exit code of 0, which will prevent the main
       # command from running.
-      unless      => "${psql_path} -h localhost -p ${port} -c 'select 1' > /dev/null",
+      unless      => "${shell_escape($psql_path)}${_dboption} -h localhost -p ${port} -c 'select 1' > /dev/null",
       path        => '/usr/bin:/usr/local/bin:/bin',
     }
   }