diff --git a/src/gui.c b/src/gui.c
index 9c78dac..b9217b4 100644
--- a/src/gui.c
+++ b/src/gui.c
@@ -5360,8 +5360,10 @@
     if (type == FRD_REPLACEALL)
     {
 	ga_concat(&ga, (char_u *)"/");
-	// escape slash and backslash
-	p = vim_strsave_escaped(repl_text, (char_u *)"/\\");
+	// Escape slash and backslash.
+	// Also escape tilde and ampersand if 'magic' is set.
+	p = vim_strsave_escaped(repl_text,
+				p_magic ? (char_u *)"/\\~&" : (char_u *)"/\\");
 	if (p != NULL)
 	    ga_concat(&ga, p);
 	vim_free(p);
diff --git a/src/testdir/test_gui.vim b/src/testdir/test_gui.vim
index 29e4ecd..a249145 100644
--- a/src/testdir/test_gui.vim
+++ b/src/testdir/test_gui.vim
@@ -1580,6 +1580,12 @@
   call test_gui_event('findrepl', args)
   call assert_equal(['ONE two ONE', 'Twoo ONE two ONEo'], getline(1, '$'))
 
+  " Replace all instances with sub-replace specials
+  call cursor(1, 1)
+  let args = #{find_text: 'ONE', repl_text: '&~&', flags: 0x4, forward: 1}
+  call test_gui_event('findrepl', args)
+  call assert_equal(['&~& two &~&', 'Twoo &~& two &~&o'], getline(1, '$'))
+
   " Invalid arguments
   call assert_false(test_gui_event('findrepl', {}))
   let args = #{repl_text: 'a', flags: 1, forward: 1}
diff --git a/src/version.c b/src/version.c
index 2cf848c..f117022 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    396,
+/**/
     395,
 /**/
     394,