diff --git a/src/ConsoleUpdateStage.php b/src/ConsoleUpdateStage.php
index 071c115cc105b5129d2ba4952b2399b57a0b2cb7..7e2f09b52315f5af1fed427c59b2b9b58eff00f5 100644
--- a/src/ConsoleUpdateStage.php
+++ b/src/ConsoleUpdateStage.php
@@ -262,7 +262,11 @@ class ConsoleUpdateStage extends UpdateStage {
    *   The ID of the current stage.
    */
   protected function triggerPostApply(string $stage_id): void {
-    $arguments = "post-apply $stage_id";
+    // The stage ID needs to be quoted in order to prevent it from being parsed
+    // as a command-line option if it begins with -, which is a possibility
+    // because we use \Drupal\Component\Utility\Crypt::randomBytesBase64() to
+    // generate the stage ID, and the string it returns might begin with -.
+    $arguments = sprintf('post-apply "%s"', $stage_id);
     if ($this->isFromWeb) {
       $arguments .= ' --is-from-web';
     }