diff --git a/main_test.go b/main_test.go
index 5300c7e..ad52667 100644
--- a/main_test.go
+++ b/main_test.go
@@ -133,7 +133,9 @@ func TestScript(t *testing.T) {
 			"setenvfile":        setenvfile,
 			"grepfiles":         grepfiles,
 		},
-		UpdateScripts: *update,
+		UpdateScripts:       *update,
+		RequireExplicitExec: true,
+		RequireUniqueNames:  true,
 	}
 	if err := gotooltest.Setup(&p); err != nil {
 		t.Fatal(err)
diff --git a/testdata/script/asm.txtar b/testdata/script/asm.txtar
index 41820d7..f088370 100644
--- a/testdata/script/asm.txtar
+++ b/testdata/script/asm.txtar
@@ -3,13 +3,13 @@
 # TODO: support arm64, at least
 [!amd64] skip 'the assembly is only written for amd64'
 
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 ! binsubstr main$exe 'test/main' 'addJmp' 'AddImpl' 'garble_'
 
 # We used to panic on broken packages with assembly.
-! garble build ./broken/...
+! exec garble build ./broken/...
 stderr -count=1 'broken[/\\]asm[/\\].*MissingType'
 stderr -count=1 'broken[/\\]syntax[/\\].*unexpected newline'
 
@@ -18,10 +18,10 @@ stderr -count=1 'broken[/\\]syntax[/\\].*unexpected newline'
 # Ensure that reversing doesn't error with assembly files.
 # It should fail, as there is nothing to reverse, but without any parse error.
 stdin empty-reverse.txt
-! garble reverse .
+! exec garble reverse .
 ! stderr .
 
-garble -tiny build
+exec garble -tiny build
 exec ./main
 cmp stderr main.stderr
 ! binsubstr main$exe 'addJmp' 'AddImpl'
diff --git a/testdata/script/atomic.txtar b/testdata/script/atomic.txtar
index ba81ede..8e14e19 100644
--- a/testdata/script/atomic.txtar
+++ b/testdata/script/atomic.txtar
@@ -6,7 +6,7 @@
 [amd64] [!darwin] env GOARCH=386
 [arm64] [!darwin] env GOARCH=arm
 
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 
diff --git a/testdata/script/basic.txtar b/testdata/script/basic.txtar
index 79f4f80..b36dfb2 100644
--- a/testdata/script/basic.txtar
+++ b/testdata/script/basic.txtar
@@ -1,5 +1,5 @@
 # Check that the simplest use of garble works. Note the lack of a module or GOGARBLE.
-garble build -o=main$exe garble_main.go
+exec garble build -o=main$exe garble_main.go
 exec ./main
 cmp stderr main.stderr
 
@@ -37,7 +37,7 @@ stderr 'cannot open shared file.*did you run.*instead of "garble \[command\]"'
 # No packages should be rebuilt either, thanks to the build cache.
 cp main$exe main_old$exe
 rm main$exe
-garble build -v -o=main$exe garble_main.go
+exec garble build -v -o=main$exe garble_main.go
 ! stderr .
 bincmp main$exe main_old$exe
 
diff --git a/testdata/script/cgo.txtar b/testdata/script/cgo.txtar
index 4280d66..ff2b207 100644
--- a/testdata/script/cgo.txtar
+++ b/testdata/script/cgo.txtar
@@ -1,6 +1,6 @@
 [!cgo] skip 'this test requires cgo to be enabled'
 
-garble build
+exec garble build
 ! stderr 'warning' # check that the C toolchain is happy
 exec ./main
 cmp stdout main.stdout
@@ -13,11 +13,11 @@ env GARBLE_TEST_REVERSING=true
 exec ./main
 cp stdout reversing.stdout
 stdin reversing.stdout
-garble reverse .
+exec garble reverse .
 cmp stdout reversed.stdout
 env GARBLE_TEST_REVERSING=false
 
-garble -tiny build
+exec garble -tiny build
 exec ./main
 cmp stdout main.stdout
 
diff --git a/testdata/script/crossbuild.txtar b/testdata/script/crossbuild.txtar
index 32ed80b..aa08ca5 100644
--- a/testdata/script/crossbuild.txtar
+++ b/testdata/script/crossbuild.txtar
@@ -16,7 +16,7 @@
 [windows] env GOOS=linux
 [!arm] env GOARCH=arm
 [arm] env GOARCH=arm64
-garble build -gcflags=math/bits=-d=ssa/intrinsics/debug=1
+exec garble build -gcflags=math/bits=-d=ssa/intrinsics/debug=1
 stderr 'intrinsic substitution for Len64.*BitLen64'
 -- go.mod --
 module test/main
diff --git a/testdata/script/debugdir.txtar b/testdata/script/debugdir.txtar
index 31b278f..8a5271b 100644
--- a/testdata/script/debugdir.txtar
+++ b/testdata/script/debugdir.txtar
@@ -1,4 +1,4 @@
-garble -debugdir ./debug1 build
+exec garble -debugdir ./debug1 build
 exists 'debug1/test/main/imported/imported.go' 'debug1/test/main/main.go' 'debug1/reflect/type.go'
 exists 'debug1/runtime/map.go' 'debug1/runtime/funcdata.h' 'debug1/runtime/asm.s'
 [amd64] exists 'debug1/runtime/cpuflags_amd64.go' 'debug1/runtime/asm_amd64.s'
@@ -12,7 +12,7 @@ exists 'debug1/runtime/map.go' 'debug1/runtime/funcdata.h' 'debug1/runtime/asm.s
 # Sources from previous builds should be deleted
 cp $WORK/debug1/test/main/main.go $WORK/debug1/some_file_from_prev_build.go
 
-garble -debugdir ./debug1 build -v
+exec garble -debugdir ./debug1 build -v
 stderr 'test/main' # we force rebuilds with -debugdir
 ! exists $WORK/debug1/some_file_from_prev_build.go
 -- go.mod --
diff --git a/testdata/script/embed.txtar b/testdata/script/embed.txtar
index 85b242a..0b7ef3e 100644
--- a/testdata/script/embed.txtar
+++ b/testdata/script/embed.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 
 exec ./main
 cmp stdout main.stdout
diff --git a/testdata/script/gogarble.txtar b/testdata/script/gogarble.txtar
index 8b5f2dc..27a9f45 100644
--- a/testdata/script/gogarble.txtar
+++ b/testdata/script/gogarble.txtar
@@ -1,11 +1,11 @@
 # Ensure that "does not match any packages" works.
 env GOGARBLE=match-absolutely/nothing
-! garble build -o=out ./standalone
+! exec garble build -o=out ./standalone
 stderr '^GOGARBLE="match-absolutely/nothing" does not match any packages to be built$'
 
 # A build where just some packages are obfuscated.
 env GOGARBLE=test/main/imported
-garble -literals build -o=out ./importer
+exec garble -literals build -o=out ./importer
 
 ! binsubstr out 'some long string to obfuscate'
 binsubstr out 'some long string to not obfuscate'
@@ -14,7 +14,7 @@ binsubstr out 'some long string to not obfuscate'
 # Some of the imported std packages use "import maps" due to vendoring,
 # and a past bug made this case fail for "garble build".
 env GOGARBLE=test/main
-garble build -o=out ./stdimporter
+exec garble build -o=out ./stdimporter
 
 [short] stop # rebuilding std is slow
 
@@ -28,12 +28,12 @@ env GOGARBLE='*'
 # packages so we must properly support ImportMap.
 # Plus, some packages like net make heavy use of complex features like Cgo.
 # Note that we won't obfuscate a few std packages just yet, mainly those around runtime.
-garble build std
+exec garble build std
 
 # Link a binary importing net/http, which will catch whether or not we
 # support ImportMap when linking.
 # Also ensure we are obfuscating low-level std packages.
-garble build -o=out ./stdimporter
+exec garble build -o=out ./stdimporter
 ! binsubstr out 'http.ListenAndServe' 'debug.WriteHeapDump' 'time.Now' 'syscall.Listen'
 
 # The same low-level std packages appear in plain sight in regular builds.
@@ -45,8 +45,8 @@ binsubstr out_regular 'http.ListenAndServe' 'debug.WriteHeapDump' 'time.Now' 'sy
 # We also forcibly rebuild runtime on its own, given it used to be non-reproducible
 # due to its use of linknames pointing at std packages it doesn't depend upon.
 env GOCACHE=${WORK}/gocache-empty
-garble build -a runtime
-garble build -o=out_rebuild ./stdimporter
+exec garble build -a runtime
+exec garble build -o=out_rebuild ./stdimporter
 bincmp out_rebuild out
 -- go.mod --
 module test/main
diff --git a/testdata/script/goversion.txtar b/testdata/script/goversion.txtar
index c6b37e5..2ef4f67 100644
--- a/testdata/script/goversion.txtar
+++ b/testdata/script/goversion.txtar
@@ -6,74 +6,74 @@ env PATH=${WORK}/.bin${:}${PATH}
 
 # An empty go version.
 env TOOLCHAIN_GOVERSION=''
-! garble build
+! exec garble build
 stderr 'Go version is too old; please upgrade to Go 1\.20\.x or newer'
 
 # We should error on a devel version that's too old.
 # Note that they lacked the "goN.M-" prefix.
 env TOOLCHAIN_GOVERSION='devel +afb5fca Sun Aug 07 00:00:00 2020 +0000'
-! garble build
+! exec garble build
 stderr 'Go version is too old; please upgrade to Go 1\.20\.x or newer'
 
 # Another form of old version; with an old "goN.M-" prefix.
 env TOOLCHAIN_GOVERSION='devel go1.15-afb5fca Sun Aug 07 00:00:00 2020 +0000'
-! garble build
+! exec garble build
 stderr 'Go version "devel go1\.15-.*2020.*" is too old; please upgrade to Go 1\.20\.x'
 
 # A current devel version should be fine.
 # Note that we don't look at devel version timestamps.
 env GARBLE_TEST_GOVERSION='go1.20'
 env TOOLCHAIN_GOVERSION='devel go1.20-ad97d204f0 Sun Sep 12 16:46:58 2023 +0000'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # We should error on a stable version that's too old.
 env TOOLCHAIN_GOVERSION='go1.14'
-! garble build
+! exec garble build
 stderr 'Go version "go1\.14" is too old; please upgrade to Go 1\.20\.x or newer'
 
 # We should accept a future stable version.
 # Note that we need to bump the version of Go that supposedly built it, too.
 env GARBLE_TEST_GOVERSION='go1.28.2'
 env TOOLCHAIN_GOVERSION='go1.28.2'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # We should accept custom devel strings.
 env TOOLCHAIN_GOVERSION='devel go1.20-somecustomversion'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # The current toolchain may be older than the one that built garble.
 env GARBLE_TEST_GOVERSION='go1.21'
 env TOOLCHAIN_GOVERSION='go1.20.3'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # The current toolchain may be equal to the one that built garble.
 env GARBLE_TEST_GOVERSION='devel go1.20-6673d5d701 Sun Mar 20 16:05:03 2023 +0000'
 env TOOLCHAIN_GOVERSION='devel go1.20-6673d5d701 Sun Mar 20 16:05:03 2023 +0000'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # The current toolchain must not be newer than the one that built garble.
 env GARBLE_TEST_GOVERSION='go1.18'
 env TOOLCHAIN_GOVERSION='go1.20.1'
-! garble build
+! exec garble build
 stderr 'garble was built with "go1\.18" and is being used with "go1\.20\.1"; please rebuild garble with the newer version'
 
 # We'll error even if the difference is a minor (bugfix) level.
 # In practice it probably wouldn't matter, but in theory it could still lead to tricky bugs.
 env GARBLE_TEST_GOVERSION='go1.20.11'
 env TOOLCHAIN_GOVERSION='go1.20.14'
-! garble build
+! exec garble build
 stderr 'garble was built with "go1\.20\.11" and is being used with "go1\.20\.14"; please rebuild garble with the newer version'
 
 # If garble builds itself and is then used, it won't know what version built it.
 # As a fallback, we drop the comparison against the toolchain's version.
 env GARBLE_TEST_GOVERSION='bogus version'
 env TOOLCHAIN_GOVERSION='go1.20.3'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 -- go.mod --
 module test/main
diff --git a/testdata/script/help.txtar b/testdata/script/help.txtar
index f4581dc..a6e982a 100644
--- a/testdata/script/help.txtar
+++ b/testdata/script/help.txtar
@@ -1,29 +1,29 @@
-! garble
+! exec garble
 stderr 'Garble obfuscates Go code'
 stderr 'garble \[garble flags\] command'
 ! stderr 'usage: go build'
 ! stdout .
 
-! garble -h
+! exec garble -h
 stderr 'Garble obfuscates Go code'
 stderr 'garble \[garble flags\] command'
 ! stdout .
 
-! garble help
+! exec garble help
 stderr 'Garble obfuscates Go code'
 stderr 'garble \[garble flags\] command'
 ! stdout .
 
-! garble help foo bar
+! exec garble help foo bar
 stderr 'usage: garble help'
 ! stderr 'Garble obfuscates Go code'
 ! stdout .
 
-! garble help -h
+! exec garble help -h
 stderr 'usage: garble help'
 ! stdout .
 
-! garble build -h
+! exec garble build -h
 stderr 'garble \[garble flags\] build'
 stderr 'This command wraps "go build"'
 stderr 'usage: go build'
@@ -31,7 +31,7 @@ stderr 'Run .go help build.'
 ! stderr 'Garble obfuscates Go code'
 ! stdout .
 
-! garble test -h
+! exec garble test -h
 stderr 'garble \[garble flags\] test'
 stderr 'This command wraps "go test"'
 stderr 'usage: go test'
@@ -39,49 +39,49 @@ stderr 'Run .go help test.'
 ! stderr 'Garble obfuscates Go code'
 ! stdout .
 
-! garble reverse -h
+! exec garble reverse -h
 stderr 'garble \[garble flags\] reverse \[build flags\] package \[files\]'
 ! stderr 'usage: go '
 ! stdout .
 
-! garble help reverse
+! exec garble help reverse
 stderr 'garble \[garble flags\] reverse \[build flags\] package \[files\]'
 ! stderr 'usage: go '
 ! stdout .
 
-! garble -badflag
+! exec garble -badflag
 stderr 'flag provided but not defined'
 stderr 'garble \[garble flags\] command'
 ! stdout .
 
-! garble badcmd
+! exec garble badcmd
 stderr 'unknown command'
 
-! garble build -badflag
+! exec garble build -badflag
 stderr 'usage: go build' # TODO: is this confusing?
 ! stdout .
 
-! garble build -tiny
+! exec garble build -tiny
 stderr 'must precede command, like: garble -tiny build \./pkg'
 ! stdout .
 
-! garble build -literals
+! exec garble build -literals
 stderr 'must precede command, like: garble -literals build \./pkg'
 ! stdout .
 
-! garble build -seed=random
+! exec garble build -seed=random
 stderr 'must precede command, like: garble -seed=random build \./pkg'
 ! stdout .
 
-[!windows] ! garble toolexec /does/not/exist/compile
-[windows] ! garble toolexec C:\does\not\exist\compile
+[!windows] ! exec garble toolexec /does/not/exist/compile
+[windows] ! exec garble toolexec C:\does\not\exist\compile
 stderr 'did you run.*instead of "garble \[command\]"'
 
-! garble build badpackage
+! exec garble build badpackage
 stderr 'package badpackage is not in GOROOT'
 ! stdout .
 
-! garble build ./badpackage
+! exec garble build ./badpackage
 stderr 'directory not found'
 ! stdout .
 
@@ -90,7 +90,7 @@ stderr 'directory not found'
 # To avoid building another garble binary,
 # and to be able to use static VCS info, use an environment variable.
 # First, test without the information, and then with it.
-garble version
+exec garble version
 stdout -count=1 'mvdan.cc/garble \(devel\)'
 stdout -count=1 'Build settings'
 stdout -count=3 '-compiler|GOOS|GOARCH'
@@ -98,7 +98,7 @@ stdout -count=3 '-compiler|GOOS|GOARCH'
 
 # Obtained from a real build while developing.
 env GARBLE_TEST_BUILDSETTINGS='[{"Key":"vcs","Value":"git"},{"Key":"vcs.revision","Value":"91ea246349544769f5100c29f79cb0f173abfeea"},{"Key":"vcs.time","Value":"2022-03-18T13:45:11Z"},{"Key":"vcs.modified","Value":"true"}]'
-garble version
+exec garble version
 stdout -count=1 'mvdan\.cc/garble v0\.0\.0-20220318134511-91ea24634954'
 stdout -count=1 'Build settings'
 stdout -count=3 '-compiler|GOOS|GOARCH'
@@ -107,10 +107,10 @@ stdout -count=1 'vcs\.revision 91ea246349544769f5100c29f79cb0f173abfeea'
 stdout -count=1 'vcs\.time 2022-03-18T13:45:11Z'
 stdout -count=1 'vcs\.modified true'
 
-! garble version -flag
+! exec garble version -flag
 stderr 'usage: garble version'
 
-! garble version arg
+! exec garble version arg
 stderr 'usage: garble version'
 
 # We need a dummy module for "garble build -badflag".
diff --git a/testdata/script/implement.txtar b/testdata/script/implement.txtar
index 9ed9752..c62c8a9 100644
--- a/testdata/script/implement.txtar
+++ b/testdata/script/implement.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 cmp stdout main.stdout
 
diff --git a/testdata/script/imports.txtar b/testdata/script/imports.txtar
index 616c942..956317f 100644
--- a/testdata/script/imports.txtar
+++ b/testdata/script/imports.txtar
@@ -14,7 +14,7 @@
 #    go clean -modcache && go get -d rsc.io/quote@v1.5.2 && go test -short
 env GOMODCACHE=$WORK/modcache
 
-garble build -tags buildtag
+exec garble build -tags buildtag
 exec ./main
 cmp stdout main.stdout
 
@@ -26,7 +26,7 @@ cmp stdout main.stdout
 # No packages should be rebuilt either, thanks to the build cache.
 cp main$exe main_old$exe
 rm main$exe
-garble build -tags buildtag -v
+exec garble build -tags buildtag -v
 ! stderr .
 bincmp main$exe main_old$exe
 
@@ -36,7 +36,7 @@ cmp stdout main.stdout
 
 # Check that -literals doesn't break anything.
 # Also check that a different form of -tags still works.
-garble -literals build --tags=buildtag
+exec garble -literals build --tags=buildtag
 exec ./main
 cmp stdout main.stdout
 -- go.mod --
diff --git a/testdata/script/init.txtar b/testdata/script/init.txtar
index 1cf31d2..ac1f51c 100644
--- a/testdata/script/init.txtar
+++ b/testdata/script/init.txtar
@@ -1,6 +1,6 @@
 # Test that garble keeps init functions in the order they were declared in.
 
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 
diff --git a/testdata/script/ldflags.txtar b/testdata/script/ldflags.txtar
index ed85d6a..d40b6d5 100644
--- a/testdata/script/ldflags.txtar
+++ b/testdata/script/ldflags.txtar
@@ -7,14 +7,14 @@
 #   -X "name=value" (or with single quotes, allows spaces in value)
 env LDFLAGS='-X=main.unexportedVersion=v1.22.33 -X=main.replacedWithEmpty= -X "main.replacedWithSpaces= foo bar " -X=domain.test/main/imported.ExportedUnset=garble_replaced -X=domain.test/missing/path.missingVar=value -X=main.someType=notAVariable'
 
-garble build -ldflags=${LDFLAGS}
+exec garble build -ldflags=${LDFLAGS}
 exec ./main
 cmp stdout main.stdout
 ! binsubstr main$exe 'domain.test/main' 'unexportedVersion' 'ExportedUnset'
 
 [short] stop # no need to verify this with -short
 
-garble -tiny -literals -seed=0002deadbeef build -ldflags=${LDFLAGS}
+exec garble -tiny -literals -seed=0002deadbeef build -ldflags=${LDFLAGS}
 exec ./main
 cmp stdout main.stdout
 ! binsubstr main$exe 'unexportedVersion' 'ExportedUnset'
diff --git a/testdata/script/linker.txtar b/testdata/script/linker.txtar
index 141be66..6be3e62 100644
--- a/testdata/script/linker.txtar
+++ b/testdata/script/linker.txtar
@@ -8,7 +8,7 @@
 # those commands are likely to fail as std and cmd are their own modules.
 env GOFLAGS=-modfile=${WORK}/go.mod
 
-garble build
+exec garble build
 exec ./main
 ! cmp stderr main.stderr
 
@@ -19,7 +19,7 @@ exec ./main
 # building the linker twice, wasting CPU and disk.
 [!windows] env GOOS=windows
 [windows] env GOOS=linux
-garble build
+exec garble build
 [!windows] [exec:git]   exists ${GARBLE_CACHE_DIR}/garble/link
 [!windows] [exec:git] ! exists ${GARBLE_CACHE_DIR}/garble/link.exe
 [windows]  [exec:git] ! exists ${GARBLE_CACHE_DIR}/garble/link
diff --git a/testdata/script/linkname.txtar b/testdata/script/linkname.txtar
index be03d92..a2ee29a 100644
--- a/testdata/script/linkname.txtar
+++ b/testdata/script/linkname.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 
diff --git a/testdata/script/list_error.txtar b/testdata/script/list_error.txtar
index f7d20a5..bdc2697 100644
--- a/testdata/script/list_error.txtar
+++ b/testdata/script/list_error.txtar
@@ -1,4 +1,4 @@
-! garble build ./...
+! exec garble build ./...
 cmpenv stderr stderr.golden
 
 -- stderr.golden --
diff --git a/testdata/script/literals.txtar b/testdata/script/literals.txtar
index ff65467..c23a06e 100644
--- a/testdata/script/literals.txtar
+++ b/testdata/script/literals.txtar
@@ -1,4 +1,4 @@
-garble -literals build
+exec garble -literals build
 exec ./main$exe
 cmp stderr main.stderr
 
@@ -10,7 +10,7 @@ binsubstr main$exe 'skip typed const' 'skip typed var' 'skip typed var assign' '
 # Also check that the binary is reproducible.
 cp main$exe main_old$exe
 rm main$exe
-garble -literals build
+exec garble -literals build
 bincmp main$exe main_old$exe
 
 # Check that the program works as expected without garble.
@@ -30,7 +30,7 @@ go build
 binsubstr main$exe 'a_unique_string_that_is_part_of_all_extra_literals'
 
 # ensure we don't find the extra literals in an obfuscated build
-garble -literals -debugdir=debug1 build
+exec garble -literals -debugdir=debug1 build
 exec ./main$exe
 cmp stderr main.stderr
 ! binsubstr main$exe 'a_unique_string_that_is_part_of_all_extra_literals'
@@ -55,7 +55,7 @@ grep '^\s+type \w+ func\(byte\) \w+$' debug1/test/main/extra_literals.go
 
 # Finally, sanity check that we can build all of std with -literals.
 # Analogous to gogarble.txt.
-garble -literals build std
+exec garble -literals build std
 -- go.mod --
 module test/main
 
diff --git a/testdata/script/modinfo.txtar b/testdata/script/modinfo.txtar
index be3e8e5..c34d663 100644
--- a/testdata/script/modinfo.txtar
+++ b/testdata/script/modinfo.txtar
@@ -6,7 +6,7 @@
 [exec:git] exec git rev-parse HEAD
 [exec:git] setenvfile HEAD_COMMIT_SHA stdout
 
-garble build -tags veryuniquebuildtag
+exec garble build -tags veryuniquebuildtag
 ! binsubstr main$exe '(devel)' 'veryuniquebuildtag' ${HEAD_COMMIT_SHA}
 
 go version -m main$exe
diff --git a/testdata/script/plugin.txtar b/testdata/script/plugin.txtar
index 06d601b..0b29c40 100644
--- a/testdata/script/plugin.txtar
+++ b/testdata/script/plugin.txtar
@@ -2,7 +2,7 @@ skip # TODO: get plugins working properly. See issue #87
 
 [windows] skip 'Go plugins are not supported on Windows'
 
-garble build -buildmode=plugin ./plugin
+exec garble build -buildmode=plugin ./plugin
 binsubstr plugin.so 'PublicVar' 'PublicFunc'
 ! binsubstr plugin.so 'privateFunc'
 
@@ -16,7 +16,7 @@ binsubstr main$exe 'PublicVar' 'PublicFunc'
 
 # This used to fail, since in this case the package path for the ad-hoc plugin
 # package isn't "main", but "plugin/unnamed-*".
-garble build -buildmode=plugin plugin/main.go
+exec garble build -buildmode=plugin plugin/main.go
 
 go build -buildmode=plugin ./plugin
 binsubstr plugin.so 'PublicVar' 'PublicFunc' 'privateFunc'
diff --git a/testdata/script/position.txtar b/testdata/script/position.txtar
index a40a2b9..e02ca72 100644
--- a/testdata/script/position.txtar
+++ b/testdata/script/position.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 ! stdout 'garble_main\.go|garble_other_filename|is sorted'
 
diff --git a/testdata/script/reflect.txtar b/testdata/script/reflect.txtar
index 0f2552d..9af84b2 100644
--- a/testdata/script/reflect.txtar
+++ b/testdata/script/reflect.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 cmp stdout main.stdout
 
diff --git a/testdata/script/reverse.txtar b/testdata/script/reverse.txtar
index 2b83ccd..27e588c 100644
--- a/testdata/script/reverse.txtar
+++ b/testdata/script/reverse.txtar
@@ -1,8 +1,8 @@
 # Unknown build flags should result in errors.
-! garble reverse -badflag=foo .
+! exec garble reverse -badflag=foo .
 stderr 'flag provided but not defined'
 
-garble build
+exec garble build
 exec ./main
 cp stderr main.stderr
 
@@ -16,18 +16,18 @@ grep 'goroutine 1 \[running\]' main.stderr
 ! grep 'ExportedLib(Type|Field)|unexportedMainFunc|test/main|long_main\.go|long_lib\.go' main.stderr
 
 stdin main.stderr
-garble reverse .
+exec garble reverse .
 cmp stdout reverse.stdout
 
 # Ensure that we cleaned up the temporary files.
 # Note that we rely on the unix-like TMPDIR env var name.
 [!windows] ! grepfiles ${TMPDIR} 'garble|importcfg|cache\.gob|\.go'
 
-! garble build ./build-error
+! exec garble build ./build-error
 cp stderr build-error.stderr
 
 stdin build-error.stderr
-garble reverse ./build-error
+exec garble reverse ./build-error
 cmp stdout build-error-reverse.stdout
 
 [short] stop # no need to verify this with -short
@@ -38,17 +38,17 @@ exec ./main
 cmp stderr reverse.stdout
 
 # Ensure that we can still reverse with -literals.
-garble -literals build
+exec garble -literals build
 exec ./main
 cp stderr main-literals.stderr
 
 stdin main-literals.stderr
-garble -literals reverse .
+exec garble -literals reverse .
 cmp stdout reverse.stdout
 
 # Reversing a -literals output without the flag should fail.
 stdin main-literals.stderr
-! garble reverse .
+! exec garble reverse .
 cmp stdout main-literals.stderr
 -- go.mod --
 module test/main
diff --git a/testdata/script/run.txtar b/testdata/script/run.txtar
index c3772aa..74b8fe0 100644
--- a/testdata/script/run.txtar
+++ b/testdata/script/run.txtar
@@ -1,11 +1,11 @@
-garble run garble_main.go
+exec garble run garble_main.go
 ! stdout '^garble_main\.go 9$'
 stdout '\.go \d'
 
 [short] stop # no need to verify this with -short
 
 # also with a package
-garble run .
+exec garble run .
 ! stdout '^garble_main\.go 9$'
 stdout '\.go \d'
 
diff --git a/testdata/script/seed-cache.txtar b/testdata/script/seed-cache.txtar
index 45f6cfe..6164244 100644
--- a/testdata/script/seed-cache.txtar
+++ b/testdata/script/seed-cache.txtar
@@ -10,7 +10,7 @@ env SEED1=OQg9kACEECQ
 
 # First, ensure that mod1's garbletest.v2 is in the cache.
 cd mod1
-garble -seed=${SEED1} build gopkg.in/garbletest.v2
+exec garble -seed=${SEED1} build gopkg.in/garbletest.v2
 
 # We collect the Action IDs to ensure they're different.
 # This is one of the factors that confused garble.
@@ -20,7 +20,7 @@ cp stdout ../buildid-mod1
 # Then, do the mod2 build, using the different-but-equal garbletest.v2.
 # Ensure that our workaround's inserted garbleActionID does not end up in the binary.
 cd ../mod2
-garble -seed=${SEED1} build
+exec garble -seed=${SEED1} build
 ! binsubstr mod2$exe 'garbleActionID'
 
 go list -trimpath -export -f '{{.BuildID}}' gopkg.in/garbletest.v2
diff --git a/testdata/script/seed.txtar b/testdata/script/seed.txtar
index 0fd4b38..f461e20 100644
--- a/testdata/script/seed.txtar
+++ b/testdata/script/seed.txtar
@@ -9,7 +9,7 @@ env SEED1=OQg9kACEECQ
 env SEED2=NruiDmVz6/s
 
 # Check the binary with a given base64 encoded seed.
-garble -seed=${SEED1} build
+exec garble -seed=${SEED1} build
 exec ./main$exe
 cmp stderr main.stderr
 binsubstr main$exe 'teststring' 'imported var value'
@@ -24,7 +24,7 @@ cp stderr importedpkg-seed-static-1
 # No packages should be rebuilt either, thanks to the build cache.
 cp main$exe main_seed1$exe
 rm main$exe
-garble -seed=${SEED1}= build -v
+exec garble -seed=${SEED1}= build -v
 ! stderr .
 bincmp main$exe main_seed1$exe
 
@@ -42,11 +42,11 @@ cp stderr mainpkg-seed-static-1
 # TODO: also test that changing non-garble build parameters,
 # such as GOARCH or -tags, still results in the same hashing via the seed.
 
-garble -seed=${SEED1} -literals build
+exec garble -seed=${SEED1} -literals build
 exec ./main$exe test/main/imported
 cmp stderr importedpkg-seed-static-1
 
-garble -seed=${SEED1} -tiny build
+exec garble -seed=${SEED1} -tiny build
 exec ./main$exe test/main/imported
 cmp stderr importedpkg-seed-static-1
 
@@ -54,7 +54,7 @@ cmp stderr importedpkg-seed-static-1
 # We can't know if caching happens here, because of previous test runs.
 cp main$exe main_seed2$exe
 rm main$exe
-garble -seed=${SEED2} build
+exec garble -seed=${SEED2} build
 ! bincmp main$exe main_seed2$exe
 
 exec ./main$exe test/main/imported
@@ -62,7 +62,7 @@ cp stderr importedpkg-seed-static-2
 ! bincmp importedpkg-seed-static-2 importedpkg-seed-static-1
 
 # Use a random seed, which should always trigger a full build.
-garble -seed=random build -v
+exec garble -seed=random build -v
 stderr -count=1 '^-seed chosen at random: .+'
 stderr -count=1 '^runtime$'
 stderr -count=1 '^test/main$'
@@ -78,7 +78,7 @@ cp stderr importedpkg-seed-random-1
 # Also check that the random binary is not reproducible.
 cp main$exe main_random$exe
 rm main$exe
-garble -seed=random build -v
+exec garble -seed=random build -v
 stderr .
 ! bincmp main$exe main_random$exe
 
diff --git a/testdata/script/syntax.txtar b/testdata/script/syntax.txtar
index e13d87f..cfdaf8e 100644
--- a/testdata/script/syntax.txtar
+++ b/testdata/script/syntax.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main$exe
 cmp stderr main.stderr
 
diff --git a/testdata/script/test.txtar b/testdata/script/test.txtar
index 7b5168a..f6edbfe 100644
--- a/testdata/script/test.txtar
+++ b/testdata/script/test.txtar
@@ -1,5 +1,5 @@
 # build the test binary
-garble test -c
+exec garble test -c
 ! stdout 'PASS'
 binsubstr bar.test$exe 'TestFoo' 'TestSeparateFoo'
 ! binsubstr bar.test$exe 'LocalFoo|ImportedVar|OriginalFuncName'
@@ -25,7 +25,7 @@ stdout 'package bar_test, func name:'
 #
 # The combination of those used to result in "refusing to list non-dependency
 # package" errors, which we've currently worked around.
-garble test -v ./...
+exec garble test -v ./...
 stdout 'ok\s+test/bar\s'
 stdout 'PASS.*TestFoo'
 stdout 'PASS.*TestMain'
@@ -40,7 +40,7 @@ stdout 'ok\s+test/bar/sometest\s'
 stdout 'ok\s+test/bar/exporttest\s'
 
 # verify that non-build flags are kept
-garble test -withflag -v
+exec garble test -withflag -v
 stdout 'PASS.*TestWithFlag'
 
 # verify with regular cmd/go; OriginalFuncName should appear
diff --git a/testdata/script/tiny.txtar b/testdata/script/tiny.txtar
index d78775c..015eb35 100644
--- a/testdata/script/tiny.txtar
+++ b/testdata/script/tiny.txtar
@@ -1,5 +1,5 @@
 # Tiny mode
-garble -tiny build
+exec garble -tiny build
 ! binsubstr main$exe 'garble_main.go' 'fmt/print.go'
 env GODEBUG='allocfreetrace=1,gcpacertrace=1,gctrace=1,inittrace=1,scavenge=1,scavtrace=1,scheddetail=1,schedtrace=10'
 ! exec ./main$exe
@@ -17,7 +17,7 @@ stderr 'funcStructExported false funcStructUnexported true'
 [short] stop # no need to verify this with -short
 
 # Default mode
-garble build
+exec garble build
 ! exec ./main$exe
 stderr '^caller: [0-9a-zA-Z_]+\.go [1-9]'
 stderr '^recovered: ya like jazz?'
diff --git a/testdata/script/typeparams.txtar b/testdata/script/typeparams.txtar
index 7b41341..d7728d4 100644
--- a/testdata/script/typeparams.txtar
+++ b/testdata/script/typeparams.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 ! binsubstr main$exe ${WORK} 'garble_main.go' 'GenericFunc' 'GenericVector' 'PredeclaredSignedInteger' 'StringableSignedInteger' 'CombineEmbeds' 'GenericParam'
 -- go.mod --
 module test/main