diff --git a/src/Commands/PinCommand.php b/src/Commands/PinCommand.php
index ea660ee..db993ad 100644
--- a/src/Commands/PinCommand.php
+++ b/src/Commands/PinCommand.php
@@ -94,7 +94,7 @@ private function pattern(string $package): string
     {
         return sprintf(
             '#^Importmap::pin\("%s".*$#',
-            $package,
+            preg_quote($package),
         );
     }
 }
diff --git a/src/Packager.php b/src/Packager.php
index 6844507..f6e28fd 100644
--- a/src/Packager.php
+++ b/src/Packager.php
@@ -60,7 +60,7 @@ public function vendoredPinFor(string $package, string $url): string
     public function packaged(string $package): bool
     {
         return (bool) preg_match(
-            sprintf('#Importmap::pin\("%s"#', str_replace('#', '\#', $package)),
+            sprintf('#Importmap::pin\("%s"#', preg_quote($package)),
             File::get(base_path($this->importmapPath)),
         );
     }
@@ -86,7 +86,7 @@ private function removePackageFromImportmap(string $package)
     {
         $contents = collect(File::lines(base_path($this->importmapPath)))
             ->reject(fn (string $line) => (
-                preg_match(sprintf('#Importmap::pin\("%s"#', $package), $line)
+                preg_match(sprintf('#Importmap::pin\("%s"#', preg_quote($package)), $line)
             ))
             ->join(PHP_EOL);