diff --git a/bin/pungi-koji b/bin/pungi-koji
index 87e7f2f0..b68ef8ce 100755
--- a/bin/pungi-koji
+++ b/bin/pungi-koji
@@ -11,7 +11,7 @@ import locale
 import datetime
 import getpass
 import socket
-import pipes
+from six.moves import shlex_quote
 import json
 
 here = sys.path[0]
@@ -266,7 +266,7 @@ def run_compose(compose, create_latest_link=True, latest_link_status=None):
     compose.log_info("Pungi version: %s" % get_full_version())
     compose.log_info("User name: %s" % getpass.getuser())
     compose.log_info("Working directory: %s" % os.getcwd())
-    compose.log_info("Command line: %s" % " ".join([pipes.quote(arg) for arg in sys.argv]))
+    compose.log_info("Command line: %s" % " ".join([shlex_quote(arg) for arg in sys.argv]))
     compose.log_info("Compose top directory: %s" % compose.topdir)
     compose.log_info("Current timezone offset: %s" % pungi.util.get_tz_offset())
     compose.read_variants()
diff --git a/pungi/createiso.py b/pungi/createiso.py
index 16815544..90da6cf7 100644
--- a/pungi/createiso.py
+++ b/pungi/createiso.py
@@ -3,9 +3,9 @@
 from __future__ import print_function
 
 import os
-import pipes
 import six
 from collections import namedtuple
+from six.moves import shlex_quote
 
 from .wrappers import iso
 from .wrappers.jigdo import JigdoWrapper
@@ -22,8 +22,8 @@ def quote(str):
     expanded.
     """
     if str.startswith('$TEMPLATE'):
-        return '$TEMPLATE%s' % pipes.quote(str.replace('$TEMPLATE', '', 1))
-    return pipes.quote(str)
+        return '$TEMPLATE%s' % shlex_quote(str.replace('$TEMPLATE', '', 1))
+    return shlex_quote(str)
 
 
 def emit(f, cmd):
diff --git a/pungi/phases/buildinstall.py b/pungi/phases/buildinstall.py
index 2539e6db..a09d44d3 100644
--- a/pungi/phases/buildinstall.py
+++ b/pungi/phases/buildinstall.py
@@ -17,13 +17,13 @@
 import errno
 import os
 import time
-import pipes
 import shutil
 import re
 
 from kobo.threads import ThreadPool, WorkerThread
 from kobo.shortcuts import run
 from productmd.images import Image
+from six.moves import shlex_quote
 
 from pungi.arch import get_valid_arches
 from pungi.util import get_volid, get_arch_variant_data
@@ -100,8 +100,8 @@ class BuildinstallPhase(PhaseBase):
                                         add_arch_template_var=add_arch_template_var,
                                         noupgrade=noupgrade,
                                         log_dir=log_dir)
-        return 'rm -rf %s && %s' % (pipes.quote(output_dir),
-                                    ' '.join([pipes.quote(x) for x in lorax_cmd]))
+        return 'rm -rf %s && %s' % (shlex_quote(output_dir),
+                                    ' '.join([shlex_quote(x) for x in lorax_cmd]))
 
     def run(self):
         lorax = LoraxWrapper()
@@ -276,7 +276,7 @@ def tweak_buildinstall(compose, src, dst, arch, variant, label, volid, kickstart
 
     # copy src to temp
     # TODO: place temp on the same device as buildinstall dir so we can hardlink
-    cmd = "cp -av --remove-destination %s/* %s/" % (pipes.quote(src), pipes.quote(tmp_dir))
+    cmd = "cp -av --remove-destination %s/* %s/" % (shlex_quote(src), shlex_quote(tmp_dir))
     run(cmd)
 
     found_configs = tweak_configs(tmp_dir, volid, kickstart_file)
@@ -300,10 +300,10 @@ def tweak_buildinstall(compose, src, dst, arch, variant, label, volid, kickstart
                     run(cmd)
 
     # HACK: make buildinstall files world readable
-    run("chmod -R a+rX %s" % pipes.quote(tmp_dir))
+    run("chmod -R a+rX %s" % shlex_quote(tmp_dir))
 
     # copy temp to dst
-    cmd = "cp -av --remove-destination %s/* %s/" % (pipes.quote(tmp_dir), pipes.quote(dst))
+    cmd = "cp -av --remove-destination %s/* %s/" % (shlex_quote(tmp_dir), shlex_quote(dst))
     run(cmd)
 
     shutil.rmtree(tmp_dir)
diff --git a/pungi/phases/createiso.py b/pungi/phases/createiso.py
index 53143ee7..2d8ea601 100644
--- a/pungi/phases/createiso.py
+++ b/pungi/phases/createiso.py
@@ -16,7 +16,6 @@
 
 import os
 import time
-import pipes
 import random
 import shutil
 
@@ -24,6 +23,7 @@ import productmd.treeinfo
 from productmd.images import Image
 from kobo.threads import ThreadPool, WorkerThread
 from kobo.shortcuts import run, relative_path
+from six.moves import shlex_quote
 
 from pungi.wrappers import iso
 from pungi.wrappers.createrepo import CreaterepoWrapper
@@ -415,7 +415,7 @@ def prepare_iso(compose, arch, variant, disc_num=1, disc_count=None, split_iso_d
 
         if file_list_content:
             # write modified repodata only if there are packages available
-            run("cp -a %s/repodata %s/" % (pipes.quote(tree_dir), pipes.quote(iso_dir)))
+            run("cp -a %s/repodata %s/" % (shlex_quote(tree_dir), shlex_quote(iso_dir)))
             with open(file_list, "w") as f:
                 f.write("\n".join(file_list_content))
             cmd = repo.get_createrepo_cmd(tree_dir, update=True, database=True, skip_stat=True, pkglist=file_list, outputdir=iso_dir, workers=3, checksum=createrepo_checksum)
diff --git a/pungi/phases/live_images.py b/pungi/phases/live_images.py
index e522b9d4..311d3b62 100644
--- a/pungi/phases/live_images.py
+++ b/pungi/phases/live_images.py
@@ -17,12 +17,12 @@
 import os
 import sys
 import time
-import pipes
 import shutil
 
 from kobo.threads import ThreadPool, WorkerThread
 from kobo.shortcuts import run, save_to_file, force_list
 from productmd.images import Image
+from six.moves import shlex_quote
 
 from pungi.wrappers.kojiwrapper import KojiWrapper
 from pungi.wrappers import iso
@@ -254,7 +254,7 @@ class CreateLiveImageThread(WorkerThread):
         :param iso_path: (str) absolute path to the ISO
         """
         dir, filename = os.path.split(iso_path)
-        run("cd %s && %s" % (pipes.quote(dir), iso.get_manifest_cmd(filename)))
+        run("cd %s && %s" % (shlex_quote(dir), iso.get_manifest_cmd(filename)))
 
     def _sign_image(self, koji_wrapper, compose, cmd, koji_task_id):
         signing_key_id = compose.conf.get("signing_key_id")
diff --git a/pungi/phases/ostree_installer.py b/pungi/phases/ostree_installer.py
index c20cc5cb..9bf5e255 100644
--- a/pungi/phases/ostree_installer.py
+++ b/pungi/phases/ostree_installer.py
@@ -4,7 +4,7 @@ import os
 from kobo.threads import ThreadPool, WorkerThread
 import shutil
 from productmd import images
-import pipes
+from six.moves import shlex_quote
 from kobo import shortcuts
 
 from .base import ConfigGuardedPhase, PhaseLoggerMixin
@@ -99,7 +99,7 @@ class OstreeInstallerThread(WorkerThread):
         boot_iso = os.path.join(output_dir, 'images', 'boot.iso')
 
         shortcuts.run('cp -av %s/* %s/' %
-                      (pipes.quote(output_dir), pipes.quote(os_path)))
+                      (shlex_quote(output_dir), shlex_quote(os_path)))
         try:
             os.link(boot_iso, iso_path)
         except OSError:
@@ -164,8 +164,8 @@ class OstreeInstallerThread(WorkerThread):
             is_final=compose.supported,
             log_dir=self.logdir,
         )
-        cmd = 'rm -rf %s && %s' % (pipes.quote(output_dir),
-                                   ' '.join([pipes.quote(x) for x in lorax_cmd]))
+        cmd = 'rm -rf %s && %s' % (shlex_quote(output_dir),
+                                   ' '.join([shlex_quote(x) for x in lorax_cmd]))
 
         runroot_channel = compose.conf.get("runroot_channel")
         runroot_tag = compose.conf["runroot_tag"]
diff --git a/pungi/phases/product_img.py b/pungi/phases/product_img.py
index 72827726..9a21eed6 100644
--- a/pungi/phases/product_img.py
+++ b/pungi/phases/product_img.py
@@ -39,7 +39,7 @@ run/install/product/pyanaconda/installclasses -> ../installclasses
 import os
 import fnmatch
 import shutil
-import pipes
+from six.moves import shlex_quote
 
 from kobo.shortcuts import run
 
@@ -134,24 +134,24 @@ def create_product_img(compose, arch, variant):
     mount_tmp = compose.mkdtemp(prefix="product_img_mount_")
     cmds = [
         # allocate image
-        "dd if=/dev/zero of=%s bs=1k count=5760" % pipes.quote(image),
+        "dd if=/dev/zero of=%s bs=1k count=5760" % shlex_quote(image),
         # create file system
-        "mke2fs -F %s" % pipes.quote(image),
+        "mke2fs -F %s" % shlex_quote(image),
         # use guestmount to mount the image, which doesn't require root privileges
         # LIBGUESTFS_BACKEND=direct: running qemu directly without libvirt
-        "LIBGUESTFS_BACKEND=direct guestmount -a %s -m /dev/sda %s" % (pipes.quote(image), pipes.quote(mount_tmp)),
-        "mkdir -p %s/run/install/product" % pipes.quote(mount_tmp),
-        "cp -rp %s/* %s/run/install/product/" % (pipes.quote(product_tmp), pipes.quote(mount_tmp)),
-        "mkdir -p %s/run/install/product/pyanaconda" % pipes.quote(mount_tmp),
+        "LIBGUESTFS_BACKEND=direct guestmount -a %s -m /dev/sda %s" % (shlex_quote(image), shlex_quote(mount_tmp)),
+        "mkdir -p %s/run/install/product" % shlex_quote(mount_tmp),
+        "cp -rp %s/* %s/run/install/product/" % (shlex_quote(product_tmp), shlex_quote(mount_tmp)),
+        "mkdir -p %s/run/install/product/pyanaconda" % shlex_quote(mount_tmp),
         # compat symlink: installclasses -> run/install/product/installclasses
-        "ln -s run/install/product/installclasses %s" % pipes.quote(mount_tmp),
+        "ln -s run/install/product/installclasses %s" % shlex_quote(mount_tmp),
         # compat symlink: locale -> run/install/product/locale
-        "ln -s run/install/product/locale %s" % pipes.quote(mount_tmp),
+        "ln -s run/install/product/locale %s" % shlex_quote(mount_tmp),
         # compat symlink: run/install/product/pyanaconda/installclasses -> ../installclasses
-        "ln -s ../installclasses %s/run/install/product/pyanaconda/installclasses" % pipes.quote(mount_tmp),
-        "fusermount -u %s" % pipes.quote(mount_tmp),
+        "ln -s ../installclasses %s/run/install/product/pyanaconda/installclasses" % shlex_quote(mount_tmp),
+        "fusermount -u %s" % shlex_quote(mount_tmp),
         # tweak last mount path written in the image
-        "tune2fs -M /run/install/product %s" % pipes.quote(image),
+        "tune2fs -M /run/install/product %s" % shlex_quote(image),
     ]
     run(" && ".join(cmds))
     shutil.rmtree(mount_tmp)
@@ -188,7 +188,7 @@ def rebuild_boot_iso(compose, arch, variant, package_sets):
     tmp_dir = compose.mkdtemp(prefix="boot_iso_")
     mount_dir = compose.mkdtemp(prefix="boot_iso_mount_")
 
-    cmd = "mount -o loop %s %s" % (pipes.quote(buildinstall_boot_iso), pipes.quote(mount_dir))
+    cmd = "mount -o loop %s %s" % (shlex_quote(buildinstall_boot_iso), shlex_quote(mount_dir))
     run(cmd, logfile=log_file, show_cmd=True)
 
     images_dir = os.path.join(tmp_dir, "images")
@@ -219,19 +219,19 @@ def rebuild_boot_iso(compose, arch, variant, package_sets):
     mkisofs_cmd = iso.get_mkisofs_cmd(boot_iso, None, volid=volume_id, exclude=["./lost+found"], graft_points=graft_points_path, **mkisofs_kwargs)
     run(mkisofs_cmd, logfile=log_file, show_cmd=True)
 
-    cmd = "umount %s" % pipes.quote(mount_dir)
+    cmd = "umount %s" % shlex_quote(mount_dir)
     run(cmd, logfile=log_file, show_cmd=True)
 
     if arch == "x86_64":
-        isohybrid_cmd = "isohybrid --uefi %s" % pipes.quote(boot_iso)
+        isohybrid_cmd = "isohybrid --uefi %s" % shlex_quote(boot_iso)
         run(isohybrid_cmd, logfile=log_file, show_cmd=True)
     elif arch == "i386":
-        isohybrid_cmd = "isohybrid %s" % pipes.quote(boot_iso)
+        isohybrid_cmd = "isohybrid %s" % shlex_quote(boot_iso)
         run(isohybrid_cmd, logfile=log_file, show_cmd=True)
 
     # implant MD5SUM to iso
     isomd5sum_cmd = iso.get_implantisomd5_cmd(boot_iso, compose.supported)
-    isomd5sum_cmd = " ".join([pipes.quote(i) for i in isomd5sum_cmd])
+    isomd5sum_cmd = " ".join([shlex_quote(i) for i in isomd5sum_cmd])
     run(isomd5sum_cmd, logfile=log_file, show_cmd=True)
 
     if boot_files:
diff --git a/pungi/util.py b/pungi/util.py
index 498f8e44..678590a5 100644
--- a/pungi/util.py
+++ b/pungi/util.py
@@ -22,14 +22,13 @@ import string
 import sys
 import hashlib
 import errno
-import pipes
 import re
 import contextlib
 import traceback
 import tempfile
 import time
 import functools
-from six.moves import urllib, range
+from six.moves import urllib, range, shlex_quote
 
 from kobo.shortcuts import run, force_list
 from productmd.common import get_major_version
@@ -166,7 +165,7 @@ def explode_rpm_package(pkg_path, target_dir):
     """Explode a rpm package into target_dir."""
     pkg_path = os.path.abspath(pkg_path)
     makedirs(target_dir)
-    run("rpm2cpio %s | cpio -iuvmd && chmod -R a+rX ." % pipes.quote(pkg_path), workdir=target_dir)
+    run("rpm2cpio %s | cpio -iuvmd && chmod -R a+rX ." % shlex_quote(pkg_path), workdir=target_dir)
 
 
 def pkg_is_rpm(pkg_obj):
diff --git a/pungi/wrappers/iso.py b/pungi/wrappers/iso.py
index 31799c86..6e4fec47 100644
--- a/pungi/wrappers/iso.py
+++ b/pungi/wrappers/iso.py
@@ -16,10 +16,10 @@
 
 import os
 import sys
-import pipes
 from fnmatch import fnmatch
 import contextlib
 from functools import cmp_to_key
+from six.moves import shlex_quote
 
 from kobo.shortcuts import force_list, relative_path, run
 from pungi import util
@@ -230,7 +230,8 @@ def get_isohybrid_cmd(iso_path, arch):
 
 
 def get_manifest_cmd(iso_name):
-    return "isoinfo -R -f -i %s | grep -v '/TRANS.TBL$' | sort >> %s.manifest" % (pipes.quote(iso_name), pipes.quote(iso_name))
+    return "isoinfo -R -f -i %s | grep -v '/TRANS.TBL$' | sort >> %s.manifest" % (
+        shlex_quote(iso_name), shlex_quote(iso_name))
 
 
 def get_volume_id(path):
diff --git a/pungi/wrappers/kojiwrapper.py b/pungi/wrappers/kojiwrapper.py
index 033d29e6..982b3aa2 100644
--- a/pungi/wrappers/kojiwrapper.py
+++ b/pungi/wrappers/kojiwrapper.py
@@ -15,7 +15,6 @@
 
 
 import os
-import pipes
 import re
 import time
 import threading
@@ -24,7 +23,7 @@ import contextlib
 import koji
 from kobo.shortcuts import run
 import six
-from six.moves import configparser
+from six.moves import configparser, shlex_quote
 
 from .. import util
 from ..arch_utils import getBaseArch
@@ -106,7 +105,7 @@ class KojiWrapper(object):
         cmd.append(arch)
 
         if isinstance(command, list):
-            command = " ".join([pipes.quote(i) for i in command])
+            command = " ".join([shlex_quote(i) for i in command])
 
         # HACK: remove rpmdb and yum cache
         command = "rm -f /var/lib/rpm/__db*; rm -rf /var/cache/yum/*; set -x; " + command
diff --git a/pungi/wrappers/scm.py b/pungi/wrappers/scm.py
index bea31b41..bdcf9b60 100644
--- a/pungi/wrappers/scm.py
+++ b/pungi/wrappers/scm.py
@@ -17,9 +17,9 @@ from __future__ import absolute_import
 
 import os
 import shutil
-import pipes
 import glob
 import six
+from six.moves import shlex_quote
 
 import kobo.log
 from kobo.shortcuts import run, force_list
@@ -113,12 +113,12 @@ class GitWrapper(ScmBase):
             self.log_debug("Exporting directory %s from git %s (branch %s)..."
                            % (scm_dir, scm_root, scm_branch))
             cmd = ("/usr/bin/git archive --remote=%s %s %s | tar xf -"
-                   % (pipes.quote(scm_root), pipes.quote(scm_branch), pipes.quote(scm_dir)))
+                   % (shlex_quote(scm_root), shlex_quote(scm_branch), shlex_quote(scm_dir)))
             # git archive is not supported by http/https
             # or by smart http https://git-scm.com/book/en/v2/Git-on-the-Server-Smart-HTTP
             if scm_root.startswith("http") or self.command:
                 cmd = ("/usr/bin/git clone --depth 1 --branch=%s %s %s"
-                       % (pipes.quote(scm_branch), pipes.quote(scm_root), pipes.quote(tmp_dir)))
+                       % (shlex_quote(scm_branch), shlex_quote(scm_root), shlex_quote(tmp_dir)))
             self.retry_run(cmd, workdir=tmp_dir, show_cmd=True)
             self.run_process_command(tmp_dir)
 
@@ -137,12 +137,12 @@ class GitWrapper(ScmBase):
             self.log_debug("Exporting file %s from git %s (branch %s)..."
                            % (scm_file, scm_root, scm_branch))
             cmd = ("/usr/bin/git archive --remote=%s %s %s | tar xf -"
-                   % (pipes.quote(scm_root), pipes.quote(scm_branch), pipes.quote(scm_file)))
+                   % (shlex_quote(scm_root), shlex_quote(scm_branch), shlex_quote(scm_file)))
             # git archive is not supported by http/https
             # or by smart http https://git-scm.com/book/en/v2/Git-on-the-Server-Smart-HTTP
             if scm_root.startswith("http") or self.command:
                 cmd = ("/usr/bin/git clone --depth 1 --branch=%s %s %s"
-                       % (pipes.quote(scm_branch), pipes.quote(scm_root), pipes.quote(tmp_dir)))
+                       % (shlex_quote(scm_branch), shlex_quote(scm_root), shlex_quote(tmp_dir)))
             self.retry_run(cmd, workdir=tmp_dir, show_cmd=True)
             self.run_process_command(tmp_dir)
 
@@ -168,8 +168,8 @@ class RpmScmWrapper(ScmBase):
                 if scm_dir.endswith("/"):
                     copy_all(os.path.join(tmp_dir, scm_dir), target_dir)
                 else:
-                    run("cp -a %s %s/" % (pipes.quote(os.path.join(tmp_dir, scm_dir)),
-                                          pipes.quote(target_dir)))
+                    run("cp -a %s %s/" % (shlex_quote(os.path.join(tmp_dir, scm_dir)),
+                                          shlex_quote(target_dir)))
 
     def export_file(self, scm_root, scm_file, target_dir, scm_branch=None):
         for rpm in self._list_rpms(scm_root):
diff --git a/pungi_utils/patch_iso.py b/pungi_utils/patch_iso.py
index 2de164f4..07f276fb 100644
--- a/pungi_utils/patch_iso.py
+++ b/pungi_utils/patch_iso.py
@@ -16,10 +16,7 @@ from kobo import shortcuts
 import os
 import productmd
 import tempfile
-try:
-    from shlex import quote
-except ImportError:
-    from pipes import quote
+from six.moves import shlex_quote
 
 from pungi import util
 from pungi.phases.buildinstall import tweak_configs
@@ -27,7 +24,7 @@ from pungi.wrappers import iso
 
 
 def sh(log, cmd, *args, **kwargs):
-    log.info('Running: %s', ' '.join(quote(x) for x in cmd))
+    log.info('Running: %s', ' '.join(shlex_quote(x) for x in cmd))
     ret, out = shortcuts.run(cmd, *args, universal_newlines=True, **kwargs)
     if out:
         log.debug('%s', out)