diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,9 @@
 # encapsule releases
 
+## 0.5.1 (2026-09-15)
+- `enter` bugfix: -e=LANG must precede container
+- `enter`: allow an optional command like `run` (`enter TOOLBOX -- tmux`)
+
 ## 0.5 (2026-09-14)
 - `run`,`create`: now always act on a container image
 - `run`,`create`: set `--workdir` only when the path exists at start
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@
 `$ encapsule --version`
 
 ```
-0.5
+0.5.1
 ```
 
 `$ encapsule --help`
@@ -53,7 +53,7 @@
   backup                   Create a tarball backup of a directory
   commit                   Commit an encapsule image from a container
   create                   Create an encapsule container
-  enter                    Connect to a encapsule container
+  enter                    Connect to an encapsule container
   run                      Run a temporary encapsule container
 ```
 
@@ -113,6 +113,11 @@
 
 ### `enter` command
 `enter` is used to join an existing (typically running) encapsule container.
+An optional command can be given, as with `run`:
+
+```bash
+$ encapsule enter my-toolbox -- tmux
+```
 
 ### `commit` command
 `commit` saves a container as an encapsule image (`encapsule-CONTAINER` by default).
diff --git a/encapsule.cabal b/encapsule.cabal
--- a/encapsule.cabal
+++ b/encapsule.cabal
@@ -1,6 +1,6 @@
 cabal-version:       2.2
 name:                encapsule
-version:             0.5
+version:             0.5.1
 synopsis:            Run isolated toolbox containers with podman
 description:
         This tool (originally based on the toolbox-constrained project)
diff --git a/example/config.toml b/example/config.toml
--- a/example/config.toml
+++ b/example/config.toml
@@ -24,3 +24,7 @@
 
 [capabilities.isolation]
 volumes = ["~/isolation:~:rw"]
+
+[capabilities.ssh-agent]
+env = ["XDG_RUNTIME_DIR"]
+volumes = ["$XDG_RUNTIME_DIR/ssh-agent.sock"]
diff --git a/src/Enter.hs b/src/Enter.hs
--- a/src/Enter.hs
+++ b/src/Enter.hs
@@ -39,9 +39,10 @@
           d -> d
       homeEnv =
         if isNothing mPasswdHome then ["env", "HOME=" ++ homeDir] else []
-      execArgs = ["exec", "-it", "--user", username,
-                  "--workdir", workdir, container]
-                 ++ langEnvArgs ++ homeEnv ++ userCmd
+      execArgs = ["exec", "-it", "--user", username]
+                 ++ langEnvArgs
+                 ++ ["--workdir", workdir, container]
+                 ++ homeEnv ++ userCmd
   when (dryrun || debug) $
     putStrLn $ unwords ("podman" : map shellQuote execArgs)
   unless dryrun $ do
diff --git a/src/Main.hs b/src/Main.hs
--- a/src/Main.hs
+++ b/src/Main.hs
@@ -53,13 +53,14 @@
       <*> strArg "TOOLBOX"
     , Subcommand "create" "Create an encapsule container" $
       runCmd <$> runOpts True False
-    , Subcommand "enter" "Connect to a encapsule container" $
+    , Subcommand "enter" "Connect to an encapsule container" $
       enterCmd
       <$> dryrunOpt
       <*> debugOpt
       <*> pure True
       <*> optional (strArg "TOOLBOX")
       <*> optional projectNameOpt
+      <*> many (strArg "[--] CMD")
     , Subcommand "run" "Run a temporary encapsule container" $
       runCmd <$> runOpts False True
     ]
@@ -155,8 +156,9 @@
       cmd_ "podman" ["stop", containerName]
     else warning $ "container" +-+ containerName +-+ "not found"
 
-enterCmd :: Bool -> Bool -> Bool -> Maybe String -> Maybe ProjectName -> IO ()
-enterCmd dryrun debug running mbase mprojectname = do
+enterCmd :: Bool -> Bool -> Bool -> Maybe String -> Maybe ProjectName
+         -> [String] -> IO ()
+enterCmd dryrun debug running mbase mprojectname command = do
   regexp <-
     case mprojectname of
       Nothing -> return $ progname +=+ fromMaybe "" mbase
@@ -173,12 +175,12 @@
     [] ->
       if running
       then do
-        enterCmd dryrun debug False mbase mprojectname
+        enterCmd dryrun debug False mbase mprojectname command
       else error' "encapsule container not found"
     [c] -> do
       unless running $
         warning "no running encapsule container found"
-      enterContainer dryrun debug True c []
+      enterContainer dryrun debug True c command
     _ -> error' $ "multiple" +-+ (if running then  "running" else "") +-+ "containers match:\n" ++ unlines ps
 
 -- image management
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -174,6 +174,11 @@
               "debug sudo line for " ++ img ++ " (got: " ++
               show other ++ ")"
 
+  describe "enter" $ do
+    it "offers an optional command" $ do
+      out <- encapsule ["enter", "--help"]
+      out `shouldContain` "[--] CMD"
+
   describe "commit" $ do
     it "offers --name" $ do
       out <- encapsule ["commit", "--help"]