diff --git a/CHANGELOG.md b/CHANGELOG.md
index 784cd8630..742a2e24c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
  - #1724, Fix wrong CORS header Authentication -> Authorization - @wolfgangwalther
  - #2107, Clarify error for failed schema cache load. - @steve-chavez
    + From `Database connection lost. Retrying the connection` to `Could not query the database for the schema cache. Retrying.`
+ - #2120, Fix reading database configuration properly when `=` is present in value - @wolfgangwalther
 
 ## [9.0.0] - 2021-11-25
 
diff --git a/src/PostgREST/Config/Database.hs b/src/PostgREST/Config/Database.hs
index f5cb478f3..51c009de1 100644
--- a/src/PostgREST/Config/Database.hs
+++ b/src/PostgREST/Config/Database.hs
@@ -46,8 +46,8 @@ dbSettingsStatement = SQL.Statement sql HE.noParams decodeSettings False
       ),
       kv_settings (database, k, v) AS (
         SELECT database,
-               split_part(setting, '=', 1),
-               split_part(setting, '=', 2)
+               substr(setting, 1, strpos(setting, '=') - 1),
+               substr(setting, strpos(setting, '=') + 1)
           FROM role_setting
          WHERE setting LIKE 'pgrst.%'
       )
diff --git a/test/io/configs/expected/no-defaults-with-db.config b/test/io/configs/expected/no-defaults-with-db.config
index 890c577f1..7a5affb2a 100644
--- a/test/io/configs/expected/no-defaults-with-db.config
+++ b/test/io/configs/expected/no-defaults-with-db.config
@@ -15,8 +15,8 @@ db-uri = "<REPLACED_WITH_DB_URI>"
 db-use-legacy-gucs = false
 jwt-aud = "https://example.org"
 jwt-role-claim-key = ".\"a\".\"role\""
-jwt-secret = "OVERRIDEREALLYREALLYREALLYREALLYVERYSAFE"
-jwt-secret-is-base64 = true
+jwt-secret = "OVERRIDE=REALLY=REALLY=REALLY=REALLY=VERY=SAFE"
+jwt-secret-is-base64 = false
 log-level = "info"
 openapi-mode = "ignore-privileges"
 openapi-server-proxy-uri = "https://example.org/api"
diff --git a/test/io/db_config.sql b/test/io/db_config.sql
index 7f2dffd2a..57caf2521 100644
--- a/test/io/db_config.sql
+++ b/test/io/db_config.sql
@@ -4,8 +4,8 @@ CREATE ROLE db_config_authenticator LOGIN NOINHERIT;
 ALTER ROLE db_config_authenticator SET pgrst.jwt_aud = 'https://example.org';
 ALTER ROLE db_config_authenticator SET pgrst.openapi_server_proxy_uri = 'https://example.org/api';
 ALTER ROLE db_config_authenticator SET pgrst.raw_media_types = 'application/vnd.pgrst.db-config';
-ALTER ROLE db_config_authenticator SET pgrst.jwt_secret = 'REALLYREALLYREALLYREALLYVERYSAFE';
-ALTER ROLE db_config_authenticator SET pgrst.jwt_secret_is_base64 = 'true';
+ALTER ROLE db_config_authenticator SET pgrst.jwt_secret = 'REALLY=REALLY=REALLY=REALLY=VERY=SAFE';
+ALTER ROLE db_config_authenticator SET pgrst.jwt_secret_is_base64 = 'false';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_role_claim_key = '."a"."role"';
 ALTER ROLE db_config_authenticator SET pgrst.db_tx_end = 'commit-allow-override';
 ALTER ROLE db_config_authenticator SET pgrst.db_schemas = 'test, tenant1, tenant2';
@@ -16,7 +16,7 @@ ALTER ROLE db_config_authenticator SET pgrst.db_max_rows = '1000';
 ALTER ROLE db_config_authenticator SET pgrst.db_extra_search_path = 'public, extensions';
 
 -- override with database specific setting
-ALTER ROLE db_config_authenticator IN DATABASE :DBNAME SET pgrst.jwt_secret = 'OVERRIDEREALLYREALLYREALLYREALLYVERYSAFE';
+ALTER ROLE db_config_authenticator IN DATABASE :DBNAME SET pgrst.jwt_secret = 'OVERRIDE=REALLY=REALLY=REALLY=REALLY=VERY=SAFE';
 ALTER ROLE db_config_authenticator IN DATABASE :DBNAME SET pgrst.db_extra_search_path = 'public, extensions, private';
 
 -- other database settings that should be ignored