diff --git a/clients/common/nm-meta-setting-desc.c b/clients/common/nm-meta-setting-desc.c
index 7c1b56a90f..334b531f1b 100644
--- a/clients/common/nm-meta-setting-desc.c
+++ b/clients/common/nm-meta-setting-desc.c
@@ -3559,7 +3559,7 @@ _objlist_obj_to_str_fcn_bridge_vlans (NMMetaAccessorGetType get_type,
 
 	s = nm_bridge_vlan_to_str (vlan, NULL);
 	if (s)
-		g_string_append (str, s);
+		nm_utils_escaped_tokens_escape_gstr_assert (s, ESCAPED_TOKENS_DELIMITERS, str);
 }
 
 static gboolean
@@ -4991,6 +4991,7 @@ static const NMMetaPropertyInfo *const property_infos_BRIDGE[] = {
 				.clear_all_fcn =        OBJLIST_CLEAR_ALL_FCN       (NMSettingBridge, nm_setting_bridge_clear_vlans),
 				.obj_to_str_fcn =       _objlist_obj_to_str_fcn_bridge_vlans,
 				.set_fcn =              _objlist_set_fcn_bridge_vlans,
+				.strsplit_escaped_tokens = TRUE,
 			),
 		),
 	),
@@ -5026,6 +5027,7 @@ static const NMMetaPropertyInfo *const property_infos_BRIDGE_PORT[] = {
 				.clear_all_fcn =        OBJLIST_CLEAR_ALL_FCN       (NMSettingBridgePort, nm_setting_bridge_port_clear_vlans),
 				.obj_to_str_fcn =       _objlist_obj_to_str_fcn_bridge_vlans,
 				.set_fcn =              _objlist_set_fcn_bridge_vlans,
+				.strsplit_escaped_tokens = TRUE,
 			),
 		),
 	),
diff --git a/libnm-core/nm-keyfile.c b/libnm-core/nm-keyfile.c
index e14887ca52..a12fd3dcdf 100644
--- a/libnm-core/nm-keyfile.c
+++ b/libnm-core/nm-keyfile.c
@@ -1642,7 +1642,7 @@ bridge_vlan_parser (KeyfileReaderInfo *info, NMSetting *setting, const char *key
 
 	vlans = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_bridge_vlan_unref);
 
-	strv = nm_utils_strsplit_set (value, ",");
+	strv = nm_utils_escaped_tokens_split (value, ",");
 	if (strv) {
 		for (iter = strv; *iter; iter++) {
 			vlan = nm_bridge_vlan_from_str (*iter, &local);
@@ -2009,7 +2009,7 @@ bridge_vlan_writer (KeyfileWriterInfo *info,
 			continue;
 		if (string->len > 0)
 			g_string_append (string, ",");
-		g_string_append (string, vlan_str);
+		nm_utils_escaped_tokens_escape_gstr_assert (vlan_str, ",", string);
 	}
 
 	nm_keyfile_plugin_kf_set_string (info->keyfile,
diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index 3e29f86dbe..c6aca0211a 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -458,7 +458,7 @@ nm_bridge_vlan_from_str (const char *str, GError **error)
 	g_return_val_if_fail (str, NULL);
 	g_return_val_if_fail (!error || !*error, NULL);
 
-	tokens = nm_utils_strsplit_set (str, " ");
+	tokens = nm_utils_escaped_tokens_split (str, NM_ASCII_SPACES);
 	if (!tokens || !tokens[0]) {
 		g_set_error_literal (error,
 		                     NM_CONNECTION_ERROR,
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index 35ed11096c..a5f158a85e 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -5114,7 +5114,7 @@ read_bridge_vlans (shvarFile *ifcfg,
 
 		array = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_bridge_vlan_unref);
 
-		strv = nm_utils_strsplit_set (value, ",");
+		strv = nm_utils_escaped_tokens_split (value, ",");
 		if (strv) {
 			for (iter = strv; *iter; iter++) {
 				vlan = nm_bridge_vlan_from_str (*iter, &local);
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index 7bf8c01745..a8be7cdec2 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -1492,7 +1492,7 @@ write_bridge_vlans (NMSetting *setting,
 			return FALSE;
 		if (string->len > 0)
 			g_string_append (string, ",");
-		g_string_append (string, vlan_str);
+		nm_utils_escaped_tokens_escape_gstr_assert (vlan_str, ",", string);
 	}
 
 	svSetValueStr (ifcfg, key, string->str);