diff --git a/check.t b/check.t
index a9469bd..b4a1761 100644
--- a/check.t
+++ b/check.t
@@ -1,4 +1,4 @@
-# $MirOS: src/bin/mksh/check.t,v 1.550 2012/07/01 15:54:51 tg Exp $
+# $MirOS: src/bin/mksh/check.t,v 1.551 2012/07/20 23:22:07 tg Exp $
 # $OpenBSD: bksl-nl.t,v 1.2 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: history.t,v 1.5 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: read.t,v 1.3 2003/03/10 03:48:16 david Exp $
@@ -29,7 +29,7 @@
 # http://www.freebsd.org/cgi/cvsweb.cgi/src/tools/regression/bin/test/regress.sh?rev=HEAD
 
 expected-stdout:
-	@(#)MIRBSD KSH R40 2012/07/01
+	@(#)MIRBSD KSH R40 2012/07/21
 description:
 	Check version of shell.
 stdin:
@@ -38,7 +38,7 @@ name: KSH_VERSION
 category: shell:legacy-no
 ---
 expected-stdout:
-	@(#)LEGACY KSH R40 2012/07/01
+	@(#)LEGACY KSH R40 2012/07/21
 description:
 	Check version of legacy shell.
 stdin:
@@ -7251,6 +7251,28 @@ expected-stdout:
 	554A1C76 004A212E CB209562 .
 	6B21CF91 20E5DB5B 124EA49D .
 ---
+name: varexpand-special-quote
+description:
+	Check special ${var@Q} expansion for quoted strings
+stdin:
+	set +U
+	i=x
+	j=a\ b
+	k=$'c
+	d\xA0''e€f'
+	print -r -- "<i=$i j=$j k=$k>"
+	s="u=${i@Q} v=${j@Q} w=${k@Q}"
+	print -r -- "s=\"$s\""
+	eval "$s"
+	typeset -p u v w
+expected-stdout:
+	<i=x j=a b k=c
+	d e€f>
+	s="u=x v='a b' w=$'c\nd\240e\u20ACf'"
+	typeset u=x
+	typeset v='a b'
+	typeset w=$'c\nd\240e\u20ACf'
+---
 name: varexpand-null-1
 description:
 	Ensure empty strings expand emptily
diff --git a/eval.c b/eval.c
index 3bcebf9..73da42b 100644
--- a/eval.c
+++ b/eval.c
@@ -23,7 +23,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.120 2012/06/28 20:03:20 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.121 2012/07/20 23:22:10 tg Exp $");
 
 /*
  * string expansion
@@ -406,6 +406,15 @@ expand(const char *cp,	/* input word */
 						    (unsigned int)h);
 						break;
 					}
+					case 0x100 | 'Q':
+					    {
+						struct shf shf;
+
+						shf_sopen(NULL, 0, SHF_WR|SHF_DYNAMIC, &shf);
+						print_value_quoted(&shf, str_val(st->var));
+						x.str = shf_sclose(&shf);
+						break;
+					}
 					case '0': {
 						char *beg, *mid, *end, *stg;
 						mksh_ari_t from = 0, num = -1, flen, finc = 0;
@@ -734,6 +743,7 @@ expand(const char *cp,	/* input word */
 				case '0':
 				case '/':
 				case 0x100 | '#':
+				case 0x100 | 'Q':
 					dp = Xrestpos(ds, dp, st->base);
 					type = XSUB;
 					if (f&DOBLANK)
@@ -1161,6 +1171,7 @@ varsub(Expand *xp, const char *sp, const char *word,
 		case '0':
 		case '/':
 		case 0x100 | '#':
+		case 0x100 | 'Q':
 			return (-1);
 		}
 		if (e->loc->argc == 0) {
@@ -1188,6 +1199,7 @@ varsub(Expand *xp, const char *sp, const char *word,
 			case '0':
 			case '/':
 			case 0x100 | '#':
+			case 0x100 | 'Q':
 				return (-1);
 			}
 			XPinit(wv, 32);
@@ -1244,7 +1256,8 @@ varsub(Expand *xp, const char *sp, const char *word,
 	if (((stype < 0x100) && (ctype(c, C_SUBOP2) || c == '/' ||
 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
 	    c == '=' || c == '-' || c == '?' : c == '+'))) ||
-	    stype == (0x80 | '0') || stype == (0x100 | '#'))
+	    stype == (0x80 | '0') || stype == (0x100 | '#') ||
+	    stype == (0x100 | 'Q'))
 		/* expand word instead of variable value */
 		state = XBASE;
 	if (Flag(FNOUNSET) && xp->str == null && !zero_ok &&
diff --git a/mksh.1 b/mksh.1
index 4ab7c71..3ff1a82 100644
--- a/mksh.1
+++ b/mksh.1
@@ -1,4 +1,4 @@
-.\" $MirOS: src/bin/mksh/mksh.1,v 1.288 2012/06/29 08:11:45 tg Exp $
+.\" $MirOS: src/bin/mksh/mksh.1,v 1.289 2012/07/20 23:22:11 tg Exp $
 .\" $OpenBSD: ksh.1,v 1.143 2012/06/19 16:41:00 jmc Exp $
 .\"-
 .\" Copyright © 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
@@ -74,7 +74,7 @@
 .\" with -mandoc, it might implement .Mx itself, but we want to
 .\" use our own definition. And .Dd must come *first*, always.
 .\"
-.Dd $Mdocdate: June 29 2012 $
+.Dd $Mdocdate: July 20 2012 $
 .\"
 .\" Check which macro package we use, and do other -mdoc setup.
 .\"
@@ -1635,6 +1635,11 @@ with an optional (defaulting to zero)
 At the moment, this is NZAAT (a 32-bit hash based on
 Bob Jenkins' one-at-a-time hash), but this is not set.
 This is the hash the shell uses internally for its associative arrays.
+.Pp
+.It Pf ${ Ns Ar name Ns @Q}
+A quoted expression safe for re-entry, whose value is the value of the
+.Ar name
+parameter, is substituted.
 .El
 .Pp
 Note that
diff --git a/sh.h b/sh.h
index b114659..f6d79f7 100644
--- a/sh.h
+++ b/sh.h
@@ -157,9 +157,9 @@
 #endif
 
 #ifdef EXTERN
-__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.572 2012/07/01 15:54:57 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.573 2012/07/20 23:22:13 tg Exp $");
 #endif
-#define MKSH_VERSION "R40 2012/07/01"
+#define MKSH_VERSION "R40 2012/07/21"
 
 /* arithmetic types: C implementation */
 #if !HAVE_CAN_INTTYPES