diff --git a/modules/programs/sane-sandboxed b/modules/programs/sane-sandboxed
index a577a4a5..1afde003 100644
--- a/modules/programs/sane-sandboxed
+++ b/modules/programs/sane-sandboxed
@@ -35,6 +35,8 @@ fi
 profileDirs=()
 # isDisable: set non-empty to invoke the binary without any sandboxing
 isDisable=
+# isDryRun: don't actually execute the program or sandbox: just print the command which would be run (and which the user may run from their own shell)
+isDryRun=
 
 ### values derived directly from $argv
 # cliArgs: the actual command we'll be running inside the sandbox
@@ -292,6 +294,9 @@ parseArgs() {
       (--sane-sandbox-disable)
         isDisable=1
         ;;
+      (--sane-sandbox-dry-run)
+        isDryRun=1
+        ;;
       (--sane-sandbox-method)
         method="$1"
         shift
@@ -750,6 +755,11 @@ if [ -z "$isDisable" ]; then
   "$method"GetCli
 fi
 
+if [ -n "$isDryRun" ]; then
+  echo "dry-run: ${cliArgs[*]}"
+  exit 0
+fi
+
 exec "${cliArgs[@]}"
 
 echo "sandbox glue failed for method='$method'"