diff --git a/host-setup/bootstrap.ps1 b/host-setup/bootstrap.ps1
index 71b722e5..0a1d0878 100644
--- a/host-setup/bootstrap.ps1
+++ b/host-setup/bootstrap.ps1
@@ -488,6 +488,9 @@ function Invoke-Upgrade {
 # Installs only what is named, since the agent tools are never installed as a set nobody chose.
 function Invoke-AgentsInstall {
     if ($script:AGENT_NAMES.Count -eq 0) { die "-Agents takes the tools to install, separated by commas, or 'all'" }
+    foreach ($name in $script:AGENT_NAMES) {
+        if ($name -match '^[-\u2013\u2014\u2015]') { die "-Agents takes tool names, and '$name' starts with a dash" }
+    }
     if ($script:AGENT_NAMES -ccontains 'all') {
         if ($script:AGENT_NAMES.Count -gt 1) { die "-Agents takes 'all' alone, or a list of tool names" }
         Invoke-Tool -Tool 'install-agents.ps1' -Arguments '-Install', '-All'
diff --git a/host-setup/bootstrap.sh b/host-setup/bootstrap.sh
index 90f9796b..911164b4 100755
--- a/host-setup/bootstrap.sh
+++ b/host-setup/bootstrap.sh
@@ -409,6 +409,7 @@ parse_args() {
             IFS=',' read -r -a agent_fields <<<"$2"
             for agent_name in "${agent_fields[@]}"; do
                 if [[ -n $agent_name ]]; then
+                    [[ $agent_name != -* ]] || die "--agents takes tool names, and \"$agent_name\" starts with a dash"
                     AGENTS+=("$agent_name")
                     if [[ $agent_name == "all" ]]; then
                         saw_all=true
diff --git a/tests/test_bootstrap.py b/tests/test_bootstrap.py
index ac1fe7f4..8825d352 100755
--- a/tests/test_bootstrap.py
+++ b/tests/test_bootstrap.py
@@ -1795,6 +1795,15 @@ def test_agents_with_an_empty_list_is_refused_before_anything_runs(self) -> None
         self.assertEqual(self.steps(), [])
         self.assertEqual(list(self.data.iterdir()), [])
 
+    def test_agents_a_dash_prefixed_name_is_refused_before_anything_runs(self) -> None:
+        for given in ("--all", "-a", "herdr,--all", "-x,herdr"):
+            with self.subTest(given=given):
+                result = self.run_main(action="--agents", args=(given,))
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn("starts with a dash", result.stderr)
+                self.assertEqual(self.steps(), [])
+                self.assertEqual(list(self.data.iterdir()), [])
+
     def test_agents_with_no_list_is_refused_before_anything_runs(self) -> None:
         result = self.run_main(action="--agents")
         self.assertNotEqual(result.returncode, 0)
@@ -1972,6 +1981,14 @@ def test_empty_names_are_dropped_from_the_list(self) -> None:
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertEqual(self.steps(), ["install-agents.ps1 -Install herdr cswap"], result.stdout)
 
+    def test_a_dash_prefixed_name_is_refused(self) -> None:
+        for given in ("-All", "-a", "herdr,-All", "\u2013All", "herdr,\u2014y", "\u2015All"):
+            with self.subTest(given=given):
+                result = self.run_agents([given])
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn("starts with a dash", result.stderr)
+                self.assertEqual(self.steps(), [])
+
     def test_an_empty_list_is_refused(self) -> None:
         result = self.run_agents([","])
         self.assertNotEqual(result.returncode, 0)