diff --git a/1/trixie/docker-entrypoint.sh b/1/trixie/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/1/trixie/docker-entrypoint.sh
+++ b/1/trixie/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/3/bookworm/docker-entrypoint.sh b/3/bookworm/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/3/bookworm/docker-entrypoint.sh
+++ b/3/bookworm/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/3/trixie/docker-entrypoint.sh b/3/trixie/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/3/trixie/docker-entrypoint.sh
+++ b/3/trixie/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/3/ubi8/docker-entrypoint.sh b/3/ubi8/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/3/ubi8/docker-entrypoint.sh
+++ b/3/ubi8/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/4/bookworm/docker-entrypoint.sh b/4/bookworm/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/4/bookworm/docker-entrypoint.sh
+++ b/4/bookworm/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/4/trixie/docker-entrypoint.sh b/4/trixie/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/4/trixie/docker-entrypoint.sh
+++ b/4/trixie/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/4/ubi8/docker-entrypoint.sh b/4/ubi8/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/4/ubi8/docker-entrypoint.sh
+++ b/4/ubi8/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/5/bookworm/docker-entrypoint.sh b/5/bookworm/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/5/bookworm/docker-entrypoint.sh
+++ b/5/bookworm/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/5/trixie/docker-entrypoint.sh b/5/trixie/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/5/trixie/docker-entrypoint.sh
+++ b/5/trixie/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/5/ubi8/docker-entrypoint.sh b/5/ubi8/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/5/ubi8/docker-entrypoint.sh
+++ b/5/ubi8/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 87b4677..58923fe 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -90,9 +90,9 @@ docker_init_database_dir() {
 
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$IVORYSQL_USER" --pwfile=<(printf "%s\n" "$IVORYSQL_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
-	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/postgresql.conf
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/postgresql.conf"
 	if [ -e "$PGDATA/ivorysql.conf" ]; then
-    	sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" $PGDATA/ivorysql.conf
+		sed -ri "s!^#?(ivorysql.listen_addresses)\s*=\s*\S+.*!\1 = '*'!" "$PGDATA/ivorysql.conf"
 	fi
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
diff --git a/tests/entrypoint-pgdata.sh b/tests/entrypoint-pgdata.sh
new file mode 100644
index 0000000..34c27c9
--- /dev/null
+++ b/tests/entrypoint-pgdata.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Run from the repository root: bash tests/entrypoint-pgdata.sh
+set -Eeuo pipefail
+test_root=$(mktemp -d)
+trap 'rm -rf "$test_root"' EXIT
+for script in docker-entrypoint.sh [0-9]*/*/docker-entrypoint.sh; do
+  for directory in 'plain' 'data with spaces' 'data[1]'; do
+    for oracle_config in yes no; do
+      (
+        source "$script"
+        export PGDATA="$test_root/$directory" IVORYSQL_USER=test IVORYSQL_PASSWORD=test
+        POSTGRES_INITDB_ARGS=''
+        # Do not require a real initdb or an NSS entry for the test UID.
+        getent() { return 0; }
+        initdb() {
+          mkdir -p "$PGDATA"
+          printf "#listen_addresses = 'localhost'\n" > "$PGDATA/postgresql.conf"
+          rm -f "$PGDATA/ivorysql.conf"
+          if [[ $oracle_config == yes ]]; then
+            printf "#ivorysql.listen_addresses = 'localhost'\n" > "$PGDATA/ivorysql.conf"
+          fi
+        }
+        docker_init_database_dir
+        grep -Fx "listen_addresses = '*'" "$PGDATA/postgresql.conf" >/dev/null
+        if [[ $oracle_config == yes ]]; then
+          grep -Fx "ivorysql.listen_addresses = '*'" "$PGDATA/ivorysql.conf" >/dev/null
+        fi
+      )
+    done
+  done
+done
+echo 'All entrypoint PGDATA path checks passed'