diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 725f16fb0d..f248d9d063 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -387,15 +387,34 @@ jobs:
     - name: Check out code
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+    - name: Install Go
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      with:
+        go-version: stable
+
     - name: Download release binaries
       uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       with:
         name: binaries-${{ matrix.os }}-${{ matrix.arch }}
         path: _release
 
+    - name: Prep tests
+      run: go install github.com/rogpeppe/go-internal/cmd/testscript@latest
+
+    - name: CLI E2E tests
+      run: |
+        matches=($BINARY_PATH_GLOB) # expand glob
+        export OPA="$(pwd)/${matches[0]}"
+        chmod +x "$OPA"
+        find . -type f -name '*.txtar' -path '*/script/*' -print0 \
+          | xargs -0 -I{} testscript -e OPA {}
+      shell: bash
+      env:
+        BINARY_PATH_GLOB: _release/*/${{ matrix.exec }}
+
+    # TODO(sr): port these tests below to testscript
     - name: Test binaries (Rego)
       run: make ci-binary-smoke-test-rego BINARY=${{ matrix.exec }}
-
     - name: Test binaries (Wasm)
       run: make ci-binary-smoke-test-wasm BINARY=${{ matrix.exec }}
       if: matrix.wasm != 'disabled'
diff --git a/cmd/exec.go b/cmd/exec.go
index 9765f3d038..5bdad98671 100644
--- a/cmd/exec.go
+++ b/cmd/exec.go
@@ -83,9 +83,11 @@ e.g., ` + executable + ` exec --decision /foo/bar/baz ...
 	execCommand.Flags().StringVarP(&params.Decision, "decision", "", "", "set decision to evaluate")
 	execCommand.Flags().BoolVarP(&params.FailDefined, "fail-defined", "", false, "exits with non-zero exit code on defined/non-empty result and errors")
 	execCommand.Flags().BoolVarP(&params.Fail, "fail", "", false, "exits with non-zero exit code on undefined/empty result and errors")
+	execCommand.Flags().BoolVarP(&params.FailNonEmpty, "fail-non-empty", "", false, "exits with non-zero exit code on non-empty result and errors")
 	execCommand.Flags().VarP(params.LogLevel, "log-level", "l", "set log level")
 	execCommand.Flags().Var(params.LogFormat, "log-format", "set log format")
 	execCommand.Flags().StringVar(&params.LogTimestampFormat, "log-timestamp-format", "", "set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)")
+	execCommand.Flags().BoolVarP(&params.StdIn, "stdin-input", "I", false, "read input document from stdin rather than a static file")
 	execCommand.Flags().DurationVar(&params.Timeout, "timeout", 0, "set exec timeout with a Go-style duration, such as '5m 30s'. (default unlimited)")
 	addV0CompatibleFlag(execCommand.Flags(), &params.V0Compatible, false)
 	addV1CompatibleFlag(execCommand.Flags(), &params.V1Compatible, false)
diff --git a/cmd/testdata/script/exec.txtar b/cmd/testdata/script/exec.txtar
new file mode 100644
index 0000000000..88bfafa7a2
--- /dev/null
+++ b/cmd/testdata/script/exec.txtar
@@ -0,0 +1,21 @@
+# input from file
+exec $OPA exec --bundle policy/ --decision /pkg/p ./input.json
+stdout '"result": true'
+! stderr .
+
+# input from stdin
+stdin input.json
+exec $OPA exec --bundle policy/ --decision /pkg/p --stdin-input
+stdout '"result": true'
+! stderr .
+
+# fail on non-empty inputs
+! exec $OPA exec --bundle policy/ --fail-non-empty --decision /pkg/p ./input.json
+stdout '"result": true'
+stderr '"exec error: there were 1 failures and 0 errors counted in the results list, and --fail-non-empty is set"'
+
+-- policy/pkg.rego --
+package pkg
+p if input.foo == "bar"
+-- input.json --
+{"foo": "bar"}