diff --git a/scripts/dev/lib/postgres.ts b/scripts/dev/lib/postgres.ts
index 9a7b1f3e..a6681ec2 100644
--- a/scripts/dev/lib/postgres.ts
+++ b/scripts/dev/lib/postgres.ts
@@ -67,12 +67,16 @@ export interface LocalPostgres {
   url: string;
 }
 
-export async function ensureLocalPostgres(worktree: string, log: (msg: string) => void): Promise<LocalPostgres> {
-  const container = process.env.DEV_INSTANCE_POSTGRES_CONTAINER || "qm-dev-postgres";
-  const port = process.env.DEV_INSTANCE_POSTGRES_PORT || "55432";
-  const image = process.env.DEV_INSTANCE_POSTGRES_IMAGE || POSTGRES_IMAGE;
-  const password = process.env.DEV_INSTANCE_POSTGRES_PASSWORD || "qm-dev";
-  const volume = process.env.DEV_INSTANCE_POSTGRES_VOLUME || "qm-dev-postgres-data";
+export async function ensureLocalPostgres(
+  worktree: string,
+  env: Record<string, string>,
+  log: (msg: string) => void,
+): Promise<LocalPostgres> {
+  const container = env.DEV_INSTANCE_POSTGRES_CONTAINER || "qm-dev-postgres";
+  const port = env.DEV_INSTANCE_POSTGRES_PORT || "55432";
+  const image = env.DEV_INSTANCE_POSTGRES_IMAGE || POSTGRES_IMAGE;
+  const password = env.DEV_INSTANCE_POSTGRES_PASSWORD || "qm-dev";
+  const volume = env.DEV_INSTANCE_POSTGRES_VOLUME || "qm-dev-postgres-data";
   const dbName = worktreeDbName(worktree);
 
   if (!(await ensureDockerDaemon(log))) throw new Error("docker daemon unavailable");
@@ -130,5 +134,5 @@ export async function ensureLocalPostgres(worktree: string, log: (msg: string) =
     throw new Error(`createdb ${dbName} failed`);
   }
   log(`durability: using local Postgres container ${container} database ${dbName}`);
-  return { url: `postgres://postgres:${password}@127.0.0.1:${port}/${dbName}` };
+  return { url: `postgres://postgres:${encodeURIComponent(password)}@127.0.0.1:${port}/${dbName}` };
 }
diff --git a/scripts/dev/supervisor/main.ts b/scripts/dev/supervisor/main.ts
index 5eedb307..9bd2437f 100644
--- a/scripts/dev/supervisor/main.ts
+++ b/scripts/dev/supervisor/main.ts
@@ -343,7 +343,7 @@ async function assembleAndPrepare(spec: BootSpec): Promise<SpecInputs> {
   let durableAdminPrincipal = "";
   if (!databaseUrl) {
     try {
-      const pg = await ensureLocalPostgres(worktree, log);
+      const pg = await ensureLocalPostgres(worktree, assembled.env, log);
       databaseUrl = pg.url;
       localPg = true;
     } catch (err) {