diff --git a/packages/create/create.js b/packages/create/create.js
index e7f668fc..236df97b 100755
--- a/packages/create/create.js
+++ b/packages/create/create.js
@@ -118,12 +118,15 @@ async function safeOutputFile(file, data, options={}) {
 }
 
 async function execFile(cmd, args) {
-	const escaped = args.map(escapeArg);
-	logger.verbose(`executing ${cmd} ${escaped.join(" ")}`);
+	// Arguments are escaped here and joined into the command rather than
+	// passed to execFile. With shell: true it would only concatenate them by
+	// space without escaping anything, which is what it is deprecated for
+	// (DEP0190) as it gives the impression the arguments are made safe.
+	const command = [cmd, ...args.map(escapeArg)].join(" ");
+	logger.verbose(`executing ${command}`);
 	return new Promise((resolve, reject) => {
 		let child = child_process.execFile(
-			cmd,
-			escaped,
+			command,
 			{
 				shell: true,
 
diff --git a/test/create/escape_arg.js b/test/create/escape_arg.js
index 496737e3..720fc27a 100644
--- a/test/create/escape_arg.js
+++ b/test/create/escape_arg.js
@@ -8,10 +8,12 @@ const { escapeArg } = require("../../packages/create/escape_arg");
 const execFile = util.promisify(child_process.execFile);
 
 async function exec(file, args) {
+	// Escape the arguments and join them into the command the same way
+	// create.js does, rather than passing them to execFile which would only
+	// concatenate them by space without escaping (DEP0190).
+	const command = [file, ...args.map(escapeArg)].join(" ");
 	const { stdout, stderr } = await execFile(
-		file,
-		args.map(escapeArg),
-
+		command,
 		{ shell: true, cwd: __dirname, env: { ...process.env, pct: "%"} }
 	);
 	return { stdout: JSON.parse(stdout), stderr };