diff --git a/changelogs/fragments/fix_pull_extra.yml b/changelogs/fragments/fix_pull_extra.yml
new file mode 100644
index 00000000000..0c93c7d5566
--- /dev/null
+++ b/changelogs/fragments/fix_pull_extra.yml
@@ -0,0 +1,2 @@
+bugfixes:
+    - fix ansible-pull hanlding of extra args, complex quoting is needed for inline JSON
diff --git a/lib/ansible/cli/pull.py b/lib/ansible/cli/pull.py
index 92c790928b9..5a900b3b7ae 100644
--- a/lib/ansible/cli/pull.py
+++ b/lib/ansible/cli/pull.py
@@ -20,6 +20,7 @@ from ansible.cli import CLI
 from ansible.cli.arguments import optparse_helpers as opt_help
 from ansible.errors import AnsibleOptionsError
 from ansible.module_utils._text import to_native, to_text
+from ansible.module_utils.six.moves import shlex_quote
 from ansible.plugins.loader import module_loader
 from ansible.utils.cmd_functions import run_cmd
 from ansible.utils.display import Display
@@ -222,9 +223,8 @@ class PullCLI(CLI):
         cmd = '%s/ansible %s %s -m %s -a "%s" all -l "%s"' % (bin_path, inv_opts, base_opts,
                                                               context.CLIARGS['module_name'],
                                                               repo_opts, limit_opts)
-
         for ev in context.CLIARGS['extra_vars']:
-            cmd += ' -e "%s"' % ev
+            cmd += ' -e "%s"' % shlex_quote(ev)
 
         # Nap?
         if context.CLIARGS['sleep']:
@@ -259,7 +259,7 @@ class PullCLI(CLI):
                 cmd += " --vault-id=%s" % vault_id
 
         for ev in context.CLIARGS['extra_vars']:
-            cmd += ' -e "%s"' % ev
+            cmd += ' -e "%s"' % shlex_quote(ev)
         if context.CLIARGS['ask_sudo_pass'] or context.CLIARGS['ask_su_pass'] or context.CLIARGS['become_ask_pass']:
             cmd += ' --ask-become-pass'
         if context.CLIARGS['skip_tags']:
diff --git a/test/integration/targets/pull/runme.sh b/test/integration/targets/pull/runme.sh
index 0ad9e01ba97..b53fb45b67c 100755
--- a/test/integration/targets/pull/runme.sh
+++ b/test/integration/targets/pull/runme.sh
@@ -23,21 +23,34 @@ cd "${repo_dir}"
     git commit -m "Initial commit."
 )
 
+function pass_tests {
+	# test for https://github.com/ansible/ansible/issues/13688
+	if ! grep MAGICKEYWORD "${temp_log}"; then
+	    echo "Missing MAGICKEYWORD in output."
+	    exit 1
+	fi
+
+	# test for https://github.com/ansible/ansible/issues/13681
+	if egrep '127\.0\.0\.1.*ok' "${temp_log}"; then
+	    echo "Found host 127.0.0.1 in output. Only localhost should be present."
+	    exit 1
+	fi
+	# make sure one host was run
+	if ! egrep 'localhost.*ok' "${temp_log}"; then
+	    echo "Did not find host localhost in output."
+	    exit 1
+	fi
+}
+
 ANSIBLE_CONFIG='' ansible-pull -d "${pull_dir}" -U "${repo_dir}" "$@" | tee "${temp_log}"
 
-# test for https://github.com/ansible/ansible/issues/13688
-if ! grep MAGICKEYWORD "${temp_log}"; then
-    echo "Missing MAGICKEYWORD in output."
-    exit 1
-fi
-
-# test for https://github.com/ansible/ansible/issues/13681
-if egrep '127\.0\.0\.1.*ok' "${temp_log}"; then
-    echo "Found host 127.0.0.1 in output. Only localhost should be present."
-    exit 1
-fi
-# make sure one host was run
-if ! egrep 'localhost.*ok' "${temp_log}"; then
-    echo "Did not find host localhost in output."
-    exit 1
-fi
+pass_tests
+
+# ensure complex extra vars work
+PASSWORD='test'
+USER=${USER:-'broken_docker'}
+JSON_EXTRA_ARGS='{"docker_registries_login": [{ "docker_password": "'"${PASSWORD}"'", "docker_username": "'"${USER}"'", "docker_registry_url":"repository-manager.company.com:5001"}], "docker_registries_logout": [{ "docker_password": "'"${PASSWORD}"'", "docker_username": "'"${USER}"'", "docker_registry_url":"repository-manager.company.com:5001"}] }'
+
+ANSIBLE_CONFIG='' ansible-pull -d "${pull_dir}" -U "${repo_dir}" -e "${JSON_EXTRA_ARGS}" "$@" | tee "${temp_log}"
+
+pass_tests