diff --git a/options/m_property.c b/options/m_property.c
index 9dad34f..c67c651 100644
--- a/options/m_property.c
+++ b/options/m_property.c
@@ -264,15 +264,44 @@ char *m_properties_expand_string(const struct m_property *prop_list,
     int level = 0, skip_level = 0;
     bstr str = bstr0(str0);

+    // Stack of output start pos for each level, where at index i is the position
+    // where level i+1 starts if it needs to be re-expanded, or -1 if it doesn't.
+    // e.g. for the string "${X}${+Y}", the array will be [-1] just after X starts
+    // expanding, and [N] just after "${+Y}" starts expanding, where N is the
+    // output size thus far just before starting to process "${+Y}".
+    int *reexpand_stack = NULL;
+    int reexpand_len = 0;
+
     while (str.len) {
         if (level > 0 && bstr_eatstart0(&str, "}")) {
             if (skip && level <= skip_level)
                 skip = false;
             level--;
+
+            int from = reexpand_stack[level];
+            if (from >= 0) {
+                // re-expand ret's suffix from "from". Effectively update ret to:
+                // ret[0 .. from] + expand( ret[from .. ret_len] )
+                MP_TARRAY_APPEND(NULL, ret, ret_len, '\0');
+                char *re_out0 = m_properties_expand_string(prop_list,
+                                                           ret + from,
+                                                           ctx);
+                int out_len = strlen(re_out0);
+                ret = talloc_realloc(NULL, ret, char, from + out_len);
+                memcpy(ret + from, re_out0, out_len);
+                ret_len = from + out_len;
+                talloc_free(re_out0);
+            }
         } else if (bstr_startswith0(str, "${") && bstr_find0(str, "}") >= 0) {
             str = bstr_cut(str, 2);
             level++;

+            int from = bstr_eatstart0(&str, "+") ? ret_len : -1;  // re-expand
+            if (level > reexpand_len)
+                MP_TARRAY_APPEND(NULL, reexpand_stack, reexpand_len, from);
+            else
+                reexpand_stack[level - 1] = from;
+
             // Assume ":" and "}" can't be part of the property name
             // => if ":" comes before "}", it must be for the fallback
             int term_pos = bstrcspn(str, ":}");
@@ -308,6 +337,8 @@ char *m_properties_expand_string(const struct m_property *prop_list,
     }

     MP_TARRAY_APPEND(NULL, ret, ret_len, '\0');
+    if (reexpand_stack)
+        talloc_free(reexpand_stack);
     return ret;
 }