diff --git a/src/google/adk/cli/cli_tools_click.py b/src/google/adk/cli/cli_tools_click.py
index f884bce61a..0b601a3efc 100644
--- a/src/google/adk/cli/cli_tools_click.py
+++ b/src/google/adk/cli/cli_tools_click.py
@@ -26,6 +26,8 @@
 import sys
 import tempfile
 import textwrap
+from typing import Any
+from typing import cast
 
 import click
 from click.core import ParameterSource
@@ -46,6 +48,16 @@
     case_sensitive=False,
 )
 
+_ClickGroup = cast(type[Any], click.Group)
+
+
+class _NoWindowsGlobExpansionGroup(_ClickGroup):
+  """Click group that disables Windows glob expansion for CLI arguments."""
+
+  def main(self, *args: Any, **kwargs: Any) -> Any:
+    kwargs.setdefault("windows_expand_args", False)
+    return super().main(*args, **kwargs)
+
 
 def _logging_options():
   """Decorator to add logging options to click commands."""
@@ -235,7 +247,10 @@ def _warn_if_with_ui(with_ui: bool) -> None:
     click.secho(f"WARNING: {_ADK_WEB_WARNING}", fg="yellow", err=True)
 
 
-@click.group(context_settings={"max_content_width": 240})
+@click.group(
+    cls=_NoWindowsGlobExpansionGroup,
+    context_settings={"max_content_width": 240},
+)
 @click.version_option(version.__version__)
 def main():
   """Agent Development Kit CLI tools."""
@@ -2000,6 +2015,7 @@ def cli_api_server(
     "cloud_run",
     context_settings={
         "allow_extra_args": True,
+        "allow_interspersed_args": False,
     },
 )
 @click.option(
@@ -2176,7 +2192,34 @@ def cli_deploy_cloud_run(
 
   _warn_if_with_ui(with_ui)
 
-  gcloud_args = ctx.args
+  # Parse arguments to separate gcloud args (after --) from regular args
+  gcloud_args = []
+  if "--" in ctx.args:
+    separator_index = ctx.args.index("--")
+    gcloud_args = ctx.args[separator_index + 1 :]
+    regular_args = ctx.args[:separator_index]
+
+    # If there are regular args before --, that's an error
+    if regular_args:
+      click.secho(
+          "Error: Unexpected arguments after agent path and before '--':"
+          f" {' '.join(regular_args)}. \nOnly arguments after '--' are passed"
+          " to gcloud.",
+          fg="red",
+          err=True,
+      )
+      ctx.exit(2)
+  else:
+    # No -- separator, treat all args as an error to enforce the new behavior
+    if ctx.args:
+      click.secho(
+          f"Error: Unexpected arguments: {' '.join(ctx.args)}. \nUse '--' to"
+          " separate gcloud arguments, e.g.: adk deploy cloud_run [options]"
+          " agent_path -- --min-instances=2",
+          fg="red",
+          err=True,
+      )
+      ctx.exit(2)
 
   try:
     from . import cli_deploy
diff --git a/tests/unittests/cli/utils/test_cli_tools_click.py b/tests/unittests/cli/utils/test_cli_tools_click.py
index 71a52d6d46..8124e016ea 100644
--- a/tests/unittests/cli/utils/test_cli_tools_click.py
+++ b/tests/unittests/cli/utils/test_cli_tools_click.py
@@ -88,6 +88,14 @@ def _mute_click(request, monkeypatch: pytest.MonkeyPatch) -> None:
   # monkeypatch.setattr(click, "secho", lambda *a, **k: None)
 
 
+def test_main_disables_click_windows_glob_expansion() -> None:
+  """Verifies the ADK CLI disables Click's Windows glob expansion."""
+  with mock.patch.object(click.Group, "main", return_value=None) as mock_main:
+    cli_tools_click.main.main(args=["web", ".", "--allow_origins", "*"])
+
+  assert mock_main.call_args.kwargs["windows_expand_args"] is False
+
+
 # validate_exclusive
 def test_validate_exclusive_allows_single() -> None:
   """Providing exactly one exclusive option should pass."""