diff --git a/source/connection-string/connection-string-spec.md b/source/connection-string/connection-string-spec.md
index 1837a9f849..131c6bdc9e 100644
--- a/source/connection-string/connection-string-spec.md
+++ b/source/connection-string/connection-string-spec.md
@@ -216,16 +216,24 @@ The values in connection options MUST be URL decoded by the parser. The values c
   ```
 
 - Key value pairs: A value that represents one or more key and value pairs. Multiple key value pairs are delimited by a
-  comma (","). The key is everything up to the first colon sign (":") and the value is everything afterwards. Drivers
-  MUST handle subsequent colon signs (":") within the value, unless otherwise specified in this document.\
-  If any keys
-  or values contain a comma (",") they MUST not be provided as part of the connection string, since it would interfere
-  with parsing. Key value pair example:
+  comma (","). The key is everything up to the first colon sign (":") and the value is everything afterwards. Reserved
+  characters such as ':' must be escaped according to [RFC 2396](https://www.rfc-editor.org/rfc/rfc2396)
+
+  For example:
 
   ```
   ?readPreferenceTags=dc:ny,rack:1
   ```
 
+  Drivers MUST handle unencoded colon signs (":") within the value. For example:
+
+  ```
+  ?authMechanismProperties=TOKEN_RESOURCE:mongodb%3A%2F%2F...
+  ```
+
+  If any keys or values contain a comma (",") they MUST not be provided as part of the connection string, since it would
+  interfere with parsing.
+
 Any invalid Values for a given key MUST be ignored and MUST log a WARN level message. For example:
 
 ```
@@ -447,6 +455,8 @@ many languages treat strings as `x-www-form-urlencoded` data by default.
 
 ## Changelog
 
+- 2024-05-29: Clarify handling of key-value pairs and add specification test.
+
 - 2024-02-15: Migrated from reStructuredText to Markdown.
 
 - 2016-07-22: In Port section, clarify that zero is not an acceptable port.
diff --git a/source/connection-string/tests/invalid-uris.yml b/source/connection-string/tests/invalid-uris.yml
index 79e110c79d..dd4d4ce31c 100644
--- a/source/connection-string/tests/invalid-uris.yml
+++ b/source/connection-string/tests/invalid-uris.yml
@@ -249,5 +249,3 @@ tests:
         hosts: ~
         auth: ~
         options: ~
-
-    
diff --git a/source/connection-string/tests/valid-options.json b/source/connection-string/tests/valid-options.json
index 01bc2264bb..34382e090a 100644
--- a/source/connection-string/tests/valid-options.json
+++ b/source/connection-string/tests/valid-options.json
@@ -37,6 +37,25 @@
       "options": {
         "tls": true
       }
+    },
+    {
+      "description": "Colon in a key value pair",
+      "uri": "mongodb://example.com?authMechanismProperties=TOKEN_RESOURCE:mongodb%3A%2F%2Ftest-cluster",
+      "valid": true,
+      "warning": false,
+      "hosts": [
+        {
+          "type": "hostname",
+          "host": "example.com",
+          "port": null
+        }
+      ],
+      "auth": null,
+      "options": {
+        "authmechanismProperties": {
+          "TOKEN_RESOURCE": "mongodb://test-cluster"
+        }
+      }
     }
   ]
 }
diff --git a/source/connection-string/tests/valid-options.yml b/source/connection-string/tests/valid-options.yml
index 8cb0dea3a6..df6460f170 100644
--- a/source/connection-string/tests/valid-options.yml
+++ b/source/connection-string/tests/valid-options.yml
@@ -28,3 +28,17 @@ tests:
         auth: ~
         options:
               tls: true
+    -
+        description: Colon in a key value pair
+        uri: mongodb://example.com?authMechanismProperties=TOKEN_RESOURCE:mongodb%3A%2F%2Ftest-cluster
+        valid: true
+        warning: false
+        hosts:
+            - 
+                type: hostname
+                host: example.com
+                port: ~
+        auth: ~
+        options:
+        authmechanismProperties:
+            TOKEN_RESOURCE: 'mongodb://test-cluster'
\ No newline at end of file