diff --git a/changelogs/fragments/fix_pull_extra.yml b/changelogs/fragments/fix_pull_extra.yml
new file mode 100644
index 00000000000..0c93c7d5566
--- /dev/null
+++ b/changelogs/fragments/fix_pull_extra.yml
@@ -0,0 +1,2 @@
+bugfixes:
+    - fix ansible-pull hanlding of extra args, complex quoting is needed for inline JSON
diff --git a/lib/ansible/cli/pull.py b/lib/ansible/cli/pull.py
index d6377ae9b05..40b915009ca 100644
--- a/lib/ansible/cli/pull.py
+++ b/lib/ansible/cli/pull.py
@@ -32,6 +32,7 @@ from ansible.cli import CLI
 from ansible import constants as C
 from ansible.errors import AnsibleOptionsError
 from ansible.module_utils._text import to_native, to_text
+from ansible.module_utils.six.moves import shlex_quote
 from ansible.plugins.loader import module_loader
 from ansible.utils.cmd_functions import run_cmd
 
@@ -234,7 +235,7 @@ class PullCLI(CLI):
         cmd = '%s/ansible %s %s -m %s -a "%s" all -l "%s"' % (bin_path, inv_opts, base_opts, self.options.module_name, repo_opts, limit_opts)
 
         for ev in self.options.extra_vars:
-            cmd += ' -e "%s"' % ev
+            cmd += ' -e %s' % shlex_quote(ev)
 
         # Nap?
         if self.options.sleep:
@@ -269,7 +270,7 @@ class PullCLI(CLI):
                 cmd += " --vault-id=%s" % vault_id
 
         for ev in self.options.extra_vars:
-            cmd += ' -e "%s"' % ev
+            cmd += ' -e %s' % shlex_quote(ev)
         if self.options.ask_sudo_pass or self.options.ask_su_pass or self.options.become_ask_pass:
             cmd += ' --ask-become-pass'
         if self.options.skip_tags:
diff --git a/test/integration/targets/pull/pull-integration-test/local.yml b/test/integration/targets/pull/pull-integration-test/local.yml
index f251b43473b..3a924fa3fe4 100644
--- a/test/integration/targets/pull/pull-integration-test/local.yml
+++ b/test/integration/targets/pull/pull-integration-test/local.yml
@@ -11,3 +11,9 @@
       failed_when: "'testhost1.example.com' == inventory_hostname"
     - name: final task, has to be reached for the test to succeed
       debug: msg="MAGICKEYWORD"
+
+    - name: check that extra vars are correclty passed
+      assert:
+        that:
+            - docker_registries_login is defined
+      tags: ['never', 'test_ev']
diff --git a/test/integration/targets/pull/runme.sh b/test/integration/targets/pull/runme.sh
index 0ad9e01ba97..d3632aa7947 100755
--- a/test/integration/targets/pull/runme.sh
+++ b/test/integration/targets/pull/runme.sh
@@ -23,21 +23,34 @@ cd "${repo_dir}"
     git commit -m "Initial commit."
 )
 
+function pass_tests {
+	# test for https://github.com/ansible/ansible/issues/13688
+	if ! grep MAGICKEYWORD "${temp_log}"; then
+	    echo "Missing MAGICKEYWORD in output."
+	    exit 1
+	fi
+
+	# test for https://github.com/ansible/ansible/issues/13681
+	if egrep '127\.0\.0\.1.*ok' "${temp_log}"; then
+	    echo "Found host 127.0.0.1 in output. Only localhost should be present."
+	    exit 1
+	fi
+	# make sure one host was run
+	if ! egrep 'localhost.*ok' "${temp_log}"; then
+	    echo "Did not find host localhost in output."
+	    exit 1
+	fi
+}
+
 ANSIBLE_CONFIG='' ansible-pull -d "${pull_dir}" -U "${repo_dir}" "$@" | tee "${temp_log}"
 
-# test for https://github.com/ansible/ansible/issues/13688
-if ! grep MAGICKEYWORD "${temp_log}"; then
-    echo "Missing MAGICKEYWORD in output."
-    exit 1
-fi
-
-# test for https://github.com/ansible/ansible/issues/13681
-if egrep '127\.0\.0\.1.*ok' "${temp_log}"; then
-    echo "Found host 127.0.0.1 in output. Only localhost should be present."
-    exit 1
-fi
-# make sure one host was run
-if ! egrep 'localhost.*ok' "${temp_log}"; then
-    echo "Did not find host localhost in output."
-    exit 1
-fi
+pass_tests
+
+# ensure complex extra vars work
+PASSWORD='test'
+USER=${USER:-'broken_docker'}
+JSON_EXTRA_ARGS='{"docker_registries_login": [{ "docker_password": "'"${PASSWORD}"'", "docker_username": "'"${USER}"'", "docker_registry_url":"repository-manager.company.com:5001"}], "docker_registries_logout": [{ "docker_password": "'"${PASSWORD}"'", "docker_username": "'"${USER}"'", "docker_registry_url":"repository-manager.company.com:5001"}] }'
+
+ANSIBLE_CONFIG='' ansible-pull -d "${pull_dir}" -U "${repo_dir}" -e "${JSON_EXTRA_ARGS}" "$@" --tags untagged,test_ev | tee "${temp_log}"
+
+pass_tests