diff --git a/cli-runopts.c b/cli-runopts.c
index 58b64cec543c0ab2100593f92a598ae05284f47c..b251550f7a8c2224fbef90f182384010f08e0e88 100644
--- a/cli-runopts.c
+++ b/cli-runopts.c
@@ -218,8 +218,12 @@ void cli_getopts(int argc, char ** argv) {
 
 		if (argv[i][0] == '-') {
 			/* A flag *waves* */
-
-			switch (argv[i][1]) {
+			char c = argv[i][1];
+			if (strlen(argv[i]) != 2) {
+				/* Ensure only one flag per hyphen. '?' falls through to print help */
+				c = '?';
+			}
+			switch (c) {
 				case 'y': /* always accept the remote hostkey */
 					if (cli_opts.always_accept_key) {
 						/* twice means no checking at all */
diff --git a/dbclient.1 b/dbclient.1
index cf9c64776f5b3be2d27866d1e3e881b25348beba..c33f9554fa2e27ce7a4ab7214499bf0cff1af73c 100644
--- a/dbclient.1
+++ b/dbclient.1
@@ -3,7 +3,7 @@
 dbclient \- lightweight SSH client
 .SH SYNOPSIS
 .B dbclient
-[\-Tt] [\-p
+[flag arguments] [\-p
 .I port\fR] [\-i
 .I id\fR] [\-L
 .I l\fR:\fIh\fR:\fIr\fR] [\-R
diff --git a/dropbear.8 b/dropbear.8
index d129a5d3bc9090b65f295015c8fc3947bd903423..501cecf8f73e1be3c8a730c13098a80e55bea2c6 100644
--- a/dropbear.8
+++ b/dropbear.8
@@ -3,7 +3,7 @@
 dropbear \- lightweight SSH server
 .SH SYNOPSIS
 .B dropbear
-[\-RFEmwsgjki] [\-b
+[flag arguments] [\-b
 .I banner\fR] 
 [\-r
 .I hostkeyfile\fR] [\-p
diff --git a/svr-runopts.c b/svr-runopts.c
index 09fc9af56c0396500fbaf8f9a660ac4a767a50fa..acb7cc1f5eb3719078e7a6ea6ffff72f1b525e03 100644
--- a/svr-runopts.c
+++ b/svr-runopts.c
@@ -189,7 +189,12 @@ void svr_getopts(int argc, char ** argv) {
 		}
 
 		if (argv[i][0] == '-') {
-			switch (argv[i][1]) {
+			char c = argv[i][1];
+			if (strlen(argv[i]) != 2) {
+				/* Ensure only one flag per hyphen. '?' falls through to print help */
+				c = '?';
+			}
+			switch (c) {
 				case 'b':
 					next = &svr_opts.bannerfile;
 					break;