diff --git a/scripts/emit-release-fragment.sh b/scripts/emit-release-fragment.sh
index bfb9510..a4d1927 100755
--- a/scripts/emit-release-fragment.sh
+++ b/scripts/emit-release-fragment.sh
@@ -20,15 +20,25 @@ if [[ -n "${FRAG_FILE:-}" && -f "${FRAG_FILE}" ]]; then
   checksum="$(sha256sum "$FRAG_FILE" | cut -d' ' -f1)"
 fi
 
+json_escape() {
+  local s="$1"
+  s="${s//\\/\\\\}"
+  s="${s//\"/\\\"}"
+  s="${s//$'\n'/\\n}"
+  s="${s//$'\r'/\\r}"
+  s="${s//$'\t'/\\t}"
+  printf '%s' "$s"
+}
+
 cat > "$out" <<JSON
 {
-  "repo": "$FRAG_REPO",
-  "sha": "$FRAG_SHA",
-  "artifact": "$FRAG_ARTIFACT",
-  "digest": "${FRAG_DIGEST:-}",
+  "repo": "$(json_escape "$FRAG_REPO")",
+  "sha": "$(json_escape "$FRAG_SHA")",
+  "artifact": "$(json_escape "$FRAG_ARTIFACT")",
+  "digest": "$(json_escape "${FRAG_DIGEST:-}")",
   "sha256": "$checksum",
-  "publish_url": "${FRAG_URL:-}",
-  "run_id": "${FRAG_RUN_ID:-}"
+  "publish_url": "$(json_escape "${FRAG_URL:-}")",
+  "run_id": "$(json_escape "${FRAG_RUN_ID:-}")"
 }
 JSON
 echo "emit-release-fragment: wrote $out"
diff --git a/tests/release-fragment-contract.sh b/tests/release-fragment-contract.sh
new file mode 100755
index 0000000..c6d83b1
--- /dev/null
+++ b/tests/release-fragment-contract.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+cd "$repo_root"
+FRAG_REPO='sow-tools' \
+FRAG_SHA='abc123' \
+FRAG_ARTIFACT='registry.example/sow/sow-tools:"quoted"' \
+FRAG_URL=$'https://example.invalid/releases\nnext' \
+FRAG_RUN_ID='run-1' \
+FRAG_OUT="$tmp/fragment.json" \
+  ./scripts/emit-release-fragment.sh
+
+jq -e '.repo == "sow-tools" and .artifact == "registry.example/sow/sow-tools:\"quoted\"" and (.publish_url | contains("next"))' \
+  "$tmp/fragment.json" >/dev/null
+
+echo "release-fragment-contract: JSON escapes env values"