diff --git a/packages/void/src/cli/cf-version-runner.ts b/packages/void/src/cli/cf-version-runner.ts
index c665f2381..54cfe8063 100644
--- a/packages/void/src/cli/cf-version-runner.ts
+++ b/packages/void/src/cli/cf-version-runner.ts
@@ -621,7 +621,8 @@ export function createCfVersionRunner(options: {
             'versions',
             'create',
             '--prebuilt',
-            ...(operation.message ? ['--message', operation.message] : []),
+            // One argv item, so a message that starts with "-" is not read as a flag.
+            ...(operation.message ? [`--message=${operation.message}`] : []),
             ...(operation.secretsFilePath ? ['--secrets-file', operation.secretsFilePath] : []),
             ...(operation.previewAlias ? ['--preview-alias', operation.previewAlias] : []),
           ],
@@ -696,7 +697,8 @@ export function createCfVersionRunner(options: {
           [
             'deploy',
             '--prebuilt',
-            ...(operation.message ? ['--message', operation.message] : []),
+            // One argv item, so a message that starts with "-" is not read as a flag.
+            ...(operation.message ? [`--message=${operation.message}`] : []),
             ...(operation.secretsFilePath ? ['--secrets-file', operation.secretsFilePath] : []),
           ],
           command.capture,
diff --git a/packages/void/src/cli/cloudflare-operation-process.ts b/packages/void/src/cli/cloudflare-operation-process.ts
index 82c1f4eba..844fb7e23 100644
--- a/packages/void/src/cli/cloudflare-operation-process.ts
+++ b/packages/void/src/cli/cloudflare-operation-process.ts
@@ -662,7 +662,8 @@ async function resources(): Promise<Result> {
   switch (operation.type) {
     case 'd1.execute': {
       const database = d1Database(operation.database);
-      return runCf(['d1', 'query', database.id, '--sql', operation.sql]);
+      // One argv item, so cf cannot read SQL that starts with "-" (such as a comment) as a flag.
+      return runCf(['d1', 'query', database.id, `--sql=${operation.sql}`]);
     }
     case 'd1.migrations.list':
     case 'd1.migrations.apply': {
@@ -1116,7 +1117,8 @@ async function workerChanges(): Promise<Result> {
         [
           ...(request.type === 'worker.deploy' ? ['deploy'] : ['workers', 'versions', 'create']),
           '--prebuilt',
-          ...(request.message ? ['--message', request.message] : []),
+          // One argv item, so a message that starts with "-" is not read as a flag.
+          ...(request.message ? [`--message=${request.message}`] : []),
           ...(request.secretsFilePath ? ['--secrets-file', request.secretsFilePath] : []),
         ],
         directory,
diff --git a/packages/void/test/unit/cf-version-runner.test.ts b/packages/void/test/unit/cf-version-runner.test.ts
index f737eb8a3..8753a2011 100644
--- a/packages/void/test/unit/cf-version-runner.test.ts
+++ b/packages/void/test/unit/cf-version-runner.test.ts
@@ -2547,8 +2547,7 @@ it('preserves activation metadata and sorts cf version history for the existing
       'versions',
       'create',
       '--prebuilt',
-      '--message',
-      'void:metadata',
+      '--message=void:metadata',
       '--preview-alias',
       'void-ready',
     ]);
diff --git a/packages/void/test/unit/cloudflare-operation-process.test.ts b/packages/void/test/unit/cloudflare-operation-process.test.ts
index ad948d241..54bf926bf 100644
--- a/packages/void/test/unit/cloudflare-operation-process.test.ts
+++ b/packages/void/test/unit/cloudflare-operation-process.test.ts
@@ -667,6 +667,45 @@ it('uses pinned cf despite a project-local CLI and preserves D1 results and the
   ]);
 }, 30_000);
 
+it('sends D1 SQL that starts with a comment as one --sql value through the pinned cf', async () => {
+  const directory = temporaryDirectory('void-cf-d1-comment-sql-');
+  const bodies: Array<unknown> = [];
+  const api = await listen(
+    createServer(async (request, response) => {
+      let body = '';
+      for await (const chunk of request) {
+        body += chunk;
+      }
+      bodies.push(JSON.parse(body));
+      response.setHeader('Content-Type', 'application/json');
+      response.end(
+        JSON.stringify({
+          success: true,
+          errors: [],
+          messages: [],
+          result: [{ results: [], success: true, meta: {} }],
+        }),
+      );
+    }),
+  );
+  const configPath = join(directory, 'wrangler.json');
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      account_id: 'test-account',
+      d1_databases: [{ binding: 'DB', database_id: 'test-database' }],
+    }),
+  );
+  const sql = '-- leading comment\nSELECT 1;';
+  const output = await runOperation(
+    directory,
+    { type: 'd1.execute', database: 'DB', sql, configPath },
+    tokenEnv(api, 'CF_API_TOKEN'),
+  );
+  expect(output.status, output.stderr).toBe(0);
+  expect(bodies).toEqual([{ sql }]);
+}, 30_000);
+
 it('uses the configured HTTP proxy for cf resource requests', async () => {
   const directory = temporaryDirectory('void-cf-resource-proxy-');
   let proxied = 0;
@@ -1405,7 +1444,7 @@ syncBuiltinESMExports();`,
       {
         type: 'versions.upload',
         configPath,
-        message: 'review',
+        message: '-review',
         ...(interactive ? { interactive } : {}),
       },
       unproxiedEnv(api),
@@ -1418,8 +1457,7 @@ syncBuiltinESMExports();`,
       'versions',
       'create',
       '--prebuilt',
-      '--message',
-      'review',
+      '--message=-review',
     ]);
     if (interactive) {
       expect(called.stdio).toBe('inherit');