diff --git a/command/cli.go b/command/cli.go
index 4cfe0feb1..2aab10ea2 100644
--- a/command/cli.go
+++ b/command/cli.go
@@ -28,6 +28,21 @@ func (c *configType) Set(value string) error {
 	return err
 }
 
+// appendStringFlag implements flag.Value by appending each call's value
+// verbatim. Unlike sliceflag.StringFlag, it does NOT split on commas — a
+// comma is a meaningful character inside a -filter expression's value list
+// (e.g. `tags=prod,x86`), so comma-splitting would mangle the input.
+type appendStringFlag []string
+
+func (a *appendStringFlag) String() string {
+	return strings.Join(*a, " ")
+}
+
+func (a *appendStringFlag) Set(v string) error {
+	*a = append(*a, v)
+	return nil
+}
+
 // ConfigType tells what type of config we should use, it can return values
 // like "hcl" or "json".
 // Make sure Args was correctly set before.
@@ -56,7 +71,7 @@ func (ma *MetaArgs) GetConfigType() (configType, error) {
 func (ma *MetaArgs) AddFlagSets(fs *flag.FlagSet) {
 	fs.Var((*sliceflag.StringFlag)(&ma.Only), "only", "")
 	fs.Var((*sliceflag.StringFlag)(&ma.Except), "except", "")
-	fs.Var((*sliceflag.StringFlag)(&ma.Filters), "filter", "")
+	fs.Var((*appendStringFlag)(&ma.Filters), "filter", "")
 	fs.Var((*kvflag.Flag)(&ma.Vars), "var", "")
 	fs.Var((*kvflag.StringSlice)(&ma.VarFiles), "var-file", "")
 	fs.Var(&ma.ConfigType, "config-type", "set to 'hcl2' to run in hcl2 mode when no file is passed.")