diff --git a/src/netsleuth/speed.py b/src/netsleuth/speed.py
index 505e1f0..d8534c8 100644
--- a/src/netsleuth/speed.py
+++ b/src/netsleuth/speed.py
@@ -124,6 +124,9 @@ async def tier_ookla(
     iface_name: str | None = None,
     ipv4: str | None = None,
 ) -> SpeedResult:
+    if server and server.startswith("-"):
+        raise ValueError("Invalid server argument: cannot start with '-'")
+
     args = [binary, "--format=json", "--accept-license", "--accept-gdpr"]
     args += ookla_interface_args(iface_name, ipv4)
     if server:
diff --git a/tests/test_speed.py b/tests/test_speed.py
index 3722359..78699d5 100644
--- a/tests/test_speed.py
+++ b/tests/test_speed.py
@@ -287,6 +287,15 @@ async def test_tier_ookla_success_parses_json():
         assert result.idle_rtt_ms == 15.5
 
 
+
+
+async def test_tier_ookla_server_argument_injection():
+    with pytest.raises(
+        ValueError, match="Invalid server argument: cannot start with '-'"
+    ):
+        await tier_ookla("speedtest", "--hacked", 10.0)
+
+
 async def test_tier_ookla_server_args():
     mock_proc = AsyncMock()
     mock_payload = {}