diff --git a/dag/extdeps/shell/shell.dag b/dag/extdeps/shell/shell.dag
index ba1383e5b31..6b9d0b1ba01 100644
--- a/dag/extdeps/shell/shell.dag
+++ b/dag/extdeps/shell/shell.dag
@@ -204,7 +204,10 @@ service shell.Exec {
       stderr: String from "stderr"
     }
 
-    transport shell { argv: ["sh", "-c", "{script}"] }
+    transport shell {
+      argv: ["sh", "-s"]
+      stdin: script
+    }
     exit {
       0 => Unit
       nonzero => String "Script failed"
diff --git a/dag/test/claim/shell_exec_run_argv_embed_witness_test.dag b/dag/test/claim/shell_exec_run_argv_embed_witness_test.dag
new file mode 100644
index 00000000000..9b85ff4dc19
--- /dev/null
+++ b/dag/test/claim/shell_exec_run_argv_embed_witness_test.dag
@@ -0,0 +1,34 @@
+module test.claim.shell_exec_run_argv_embed_witness
+
+import std.types { Bool, String }
+import std.measure { ByteSize, byte_size, byte_size_count }
+import gunbc.live_deploy.emit { live_deploy_apply_script_for }
+import gunbc.live_deploy.spec { deployment_spec_srv1 }
+import extdeps.filesystem.filesystem_io
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+data shell_dag_path: String = "dag/extdeps/shell/shell.dag"
+
+data local_argv_embed_budget: ByteSize = byte_size(65536)
+
+fn src_has(path: String, needle: String) -> Bool {
+  let r = filesystem_read(path: path)
+  string_contains(s: r.content, pattern: needle)
+}
+
+fn witness_apply_script_exceeds_local_argv_embed_budget() -> Bool {
+  let script_len = length(live_deploy_apply_script_for(spec: deployment_spec_srv1()))
+  let budget = byte_size_count(b: local_argv_embed_budget)
+  script_len > budget
+}
+
+fn witness_shell_exec_run_uses_stdin_transport() -> Bool {
+  src_has(path: shell_dag_path, needle: "stdin: script")
+}
+
+test fn shell_exec_run_argv_embed_witnesses() -> Bool {
+  witness_apply_script_exceeds_local_argv_embed_budget()
+    && witness_shell_exec_run_uses_stdin_transport()
+}