diff --git a/party b/party
index b724434..a464a01 100755
--- a/party
+++ b/party
@@ -925,7 +925,7 @@ EOF
         # this flag (tmux switch-client cannot set read-only state),
         # so role-switching is documented as session-level only, not
         # a watcher boundary.
-        attach_cmd="$PARTY_TMUX -S $RR_SOCKET attach-session -r -t $RR_PARTY_NAME"
+        set -- attach-session -r -t "$RR_PARTY_NAME"
     else
         # Active: own session group with an independent window cursor.
         # An active guest session survives a client detach, so create it
@@ -942,15 +942,17 @@ EOF
         guest="__party_guest_$USER"
         "$PARTY_TMUX" -S "$RR_SOCKET" has-session -t "$guest" 2>/dev/null \
             || "$PARTY_TMUX" -S "$RR_SOCKET" new-session -d -t "$RR_PARTY_NAME" -s "$guest"
-        attach_cmd="$PARTY_TMUX -S $RR_SOCKET attach-session -t $guest"
+        set -- attach-session -t "$guest"
     fi
 
     if [ "${PARTY_DRY_RUN:-0}" = 1 ]; then
-        echo "$attach_cmd"
+        echo "$PARTY_TMUX -S $RR_SOCKET $*"
         return 0
     fi
-    # shellcheck disable=SC2086
-    exec $attach_cmd
+    # exec with discrete, quoted args: the old flat-string + unquoted
+    # `exec $attach_cmd` word-split on any whitespace in PARTY_TMUX or
+    # the socket path.
+    exec "$PARTY_TMUX" -S "$RR_SOCKET" "$@"
 }
 cmd_leave() {
     case "${1:-}" in