diff --git a/options/m_property.c b/options/m_property.c
index 9dad34f..0d3f6b9 100644
--- a/options/m_property.c
+++ b/options/m_property.c
@@ -263,16 +263,39 @@ char *m_properties_expand_string(const struct m_property *prop_list,
     bool skip = false;
     int level = 0, skip_level = 0;
     bstr str = bstr0(str0);
+    void *tmp = talloc_new(NULL);
+
+    // Stack where at index i we store -1 if level i+1 doesn't need re-expand
+    // once it's done, or the output position from which we should re-expand.
+    // E.g. for the string "${X}${+Y:abc${Z}}", the array will be [-1] while
+    // expanding X, [N] while expanding Y, and [N, -1] while (if) expanding Z,
+    // where N is the output size after expanding ${X}.
+    int *reexpand_stack = NULL;
+    int reexpand_len = 0;  // identical to level, kept separate for readability.

     while (str.len) {
         if (level > 0 && bstr_eatstart0(&str, "}")) {
             if (skip && level <= skip_level)
                 skip = false;
             level--;
+
+            int from = reexpand_stack[--reexpand_len];  // pop
+            if (from >= 0)  {
+                // re-expand the level's output by prepending it to the input.
+                bstr new_in = bstrdup(tmp, (bstr){ret + from, ret_len - from});
+                bstr_xappend(tmp, &new_in, str);
+                str = new_in;
+                ret_len = from;  // MP_TARRAY_APPEND can handle it cleanly.
+            }
         } else if (bstr_startswith0(str, "${") && bstr_find0(str, "}") >= 0) {
             str = bstr_cut(str, 2);
             level++;

+            // "${+" means we need to re-expand the output of the level.
+            // Record the current output pos as a starting point, or -1 if no need.
+            int from = bstr_eatstart0(&str, "+") ? ret_len : -1;
+            MP_TARRAY_APPEND(tmp, reexpand_stack, reexpand_len, from); // push
+
             // Assume ":" and "}" can't be part of the property name
             // => if ":" comes before "}", it must be for the fallback
             int term_pos = bstrcspn(str, ":}");
@@ -308,6 +331,7 @@ char *m_properties_expand_string(const struct m_property *prop_list,
     }

     MP_TARRAY_APPEND(NULL, ret, ret_len, '\0');
+    talloc_free(tmp);
     return ret;
 }