diff --git a/lib/kamal/commands/auditor.rb b/lib/kamal/commands/auditor.rb
index 9846d8e2..e4981650 100644
--- a/lib/kamal/commands/auditor.rb
+++ b/lib/kamal/commands/auditor.rb
@@ -1,5 +1,6 @@
 class Kamal::Commands::Auditor < Kamal::Commands::Base
   attr_reader :details
+  delegate :escape_shell_value, to: Kamal::Utils
 
   def initialize(config, **details)
     super(config)
@@ -9,11 +10,8 @@ class Kamal::Commands::Auditor < Kamal::Commands::Base
   # Runs remotely
   def record(line, **details)
     combine \
-      [ :mkdir, "-p", config.run_directory ],
-      append(
-        [ :echo, audit_tags(**details).except(:version, :service_version, :service).to_s, line ],
-        audit_log_file
-      )
+      make_run_directory,
+      append([ :echo, escape_shell_value(audit_line(line, **details)) ], audit_log_file)
   end
 
   def reveal
@@ -30,4 +28,12 @@ class Kamal::Commands::Auditor < Kamal::Commands::Base
     def audit_tags(**details)
       tags(**self.details, **details)
     end
+
+    def make_run_directory
+      [ :mkdir, "-p", config.run_directory ]
+    end
+
+    def audit_line(line, **details)
+      "#{audit_tags(**details).except(:version, :service_version, :service)} #{line}"
+    end
 end
diff --git a/test/commands/auditor_test.rb b/test/commands/auditor_test.rb
index 2abc8d81..d1cab610 100644
--- a/test/commands/auditor_test.rb
+++ b/test/commands/auditor_test.rb
@@ -20,8 +20,7 @@ class CommandsAuditorTest < ActiveSupport::TestCase
     assert_equal [
       :mkdir, "-p", ".kamal", "&&",
       :echo,
-      "[#{@recorded_at}] [#{@performer}]",
-      "app removed container",
+      "\"[#{@recorded_at}] [#{@performer}] app removed container\"",
       ">>", ".kamal/app-audit.log"
     ], @auditor.record("app removed container")
   end
@@ -31,8 +30,7 @@ class CommandsAuditorTest < ActiveSupport::TestCase
       assert_equal [
         :mkdir, "-p", ".kamal", "&&",
         :echo,
-        "[#{@recorded_at}] [#{@performer}] [staging]",
-        "app removed container",
+        "\"[#{@recorded_at}] [#{@performer}] [staging] app removed container\"",
         ">>", ".kamal/app-staging-audit.log"
       ], auditor.record("app removed container")
     end
@@ -43,8 +41,7 @@ class CommandsAuditorTest < ActiveSupport::TestCase
       assert_equal [
         :mkdir, "-p", ".kamal", "&&",
         :echo,
-        "[#{@recorded_at}] [#{@performer}] [web]",
-        "app removed container",
+        "\"[#{@recorded_at}] [#{@performer}] [web] app removed container\"",
         ">>", ".kamal/app-audit.log"
       ], auditor.record("app removed container")
     end
@@ -54,8 +51,7 @@ class CommandsAuditorTest < ActiveSupport::TestCase
     assert_equal [
       :mkdir, "-p", ".kamal", "&&",
       :echo,
-      "[#{@recorded_at}] [#{@performer}] [value]",
-      "app removed container",
+      "\"[#{@recorded_at}] [#{@performer}] [value] app removed container\"",
       ">>", ".kamal/app-audit.log"
     ], @auditor.record("app removed container", detail: "value")
   end