diff --git a/dokku b/dokku
index 4c3609258..c11550b80 100755
--- a/dokku
+++ b/dokku
@@ -118,7 +118,7 @@ if [[ -n "$SSH_ORIGINAL_COMMAND" ]]; then
     exit_code=$?
     set +f
   else
-    readarray -t -O "${#ssh_arg_array[@]}" ssh_arg_array < <(printf '%s' "$SSH_ORIGINAL_COMMAND" | xargs -n 1)
+    readarray -d '' -O "${#ssh_arg_array[@]}" ssh_arg_array < <(printf '%s' "$SSH_ORIGINAL_COMMAND" | xargs -r printf '%s\0')
     set -f
     $0 "${ssh_arg_array[@]}"
     exit_code=$?
diff --git a/tests/unit/core_2.bats b/tests/unit/core_2.bats
index a0f7a4591..2efe0e25c 100644
--- a/tests/unit/core_2.bats
+++ b/tests/unit/core_2.bats
@@ -37,6 +37,14 @@ teardown() {
   assert_success
 }
 
+@test "(core) ssh arguments are passed through unchanged" {
+  run ssh "dokku@$DOKKU_DOMAIN" fakecommand --version --help -n -e -E
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains '`fakecommand --version --help -n -e -E` is not a dokku command.'
+}
+
 @test "(core) urls (non-ssl)" {
   assert_urls "http://${TEST_APP}.${DOKKU_DOMAIN}"
 
diff --git a/tests/unit/run_2.bats b/tests/unit/run_2.bats
index 9d07b6075..aab7f9168 100644
--- a/tests/unit/run_2.bats
+++ b/tests/unit/run_2.bats
@@ -30,6 +30,26 @@ teardown() {
   assert_failure
 }
 
+@test "(run) run over ssh preserves echo-like arguments" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ssh dokku@$DOKKU_DOMAIN run $TEST_APP /bin/echo --version --help 2>/dev/null"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "--version --help"
+
+  # bats strips trailing newlines from $output, so count bytes to verify -n was honored
+  run /bin/bash -c "ssh dokku@$DOKKU_DOMAIN run $TEST_APP /bin/echo -n hello 2>/dev/null | wc -c"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "5"
+}
+
 @test "(run) run:detached" {
   run deploy_app
   echo "output: $output"