diff --git a/cli-chansession.c b/cli-chansession.c
index 07b9b9d69dbaaa848b53a50cf04cfd6a5f2fd7ce..dc8e64143fddb08393e031ea6647261d64e6811c 100644
--- a/cli-chansession.c
+++ b/cli-chansession.c
@@ -321,7 +321,11 @@ static void send_chansess_shell_req(struct Channel *channel) {
 	TRACE(("enter send_chansess_shell_req"))
 
 	if (cli_opts.cmd) {
-		reqtype = "exec";
+		if (cli_opts.is_subsystem) {
+			reqtype = "subsystem";
+		} else {
+			reqtype = "exec";
+		}
 	} else {
 		reqtype = "shell";
 	}
diff --git a/cli-runopts.c b/cli-runopts.c
index 0641ec7420256a5b60dbb8613326066500f4e72a..be449a3d0783f1839a7194eea711328ffa94672b 100644
--- a/cli-runopts.c
+++ b/cli-runopts.c
@@ -58,6 +58,7 @@ static void printhelp() {
 					"-N    Don't run a remote command\n"
 					"-f    Run in background after auth\n"
 					"-y    Always accept remote host key if unknown\n"
+					"-s    Request a subsystem (use for sftp)\n"
 #ifdef ENABLE_CLI_PUBKEY_AUTH
 					"-i <identityfile>   (multiple allowed)\n"
 #endif
@@ -116,6 +117,7 @@ void cli_getopts(int argc, char ** argv) {
 	cli_opts.backgrounded = 0;
 	cli_opts.wantpty = 9; /* 9 means "it hasn't been touched", gets set later */
 	cli_opts.always_accept_key = 0;
+	cli_opts.is_subsystem = 0;
 #ifdef ENABLE_CLI_PUBKEY_AUTH
 	cli_opts.privkeys = NULL;
 #endif
@@ -213,6 +215,9 @@ void cli_getopts(int argc, char ** argv) {
 				case 'f':
 					cli_opts.backgrounded = 1;
 					break;
+				case 's':
+					cli_opts.is_subsystem = 1;
+					break;
 #ifdef ENABLE_CLI_LOCALTCPFWD
 				case 'L':
 					nextislocal = 1;
diff --git a/runopts.h b/runopts.h
index e9d2363c5bcda0a3731ce482ceefea61a64a369e..cc39ee485e14b96e817d72cf5e95d0416e839444 100644
--- a/runopts.h
+++ b/runopts.h
@@ -109,6 +109,7 @@ typedef struct cli_runopts {
 	int always_accept_key;
 	int no_cmd;
 	int backgrounded;
+	int is_subsystem;
 #ifdef ENABLE_CLI_PUBKEY_AUTH
 	struct SignKeyList *privkeys; /* Keys to use for public-key auth */
 #endif