diff --git a/python/samba/tests/test_pam_winbind.sh b/python/samba/tests/test_pam_winbind.sh
index 0406b108b31..755e67280fa 100755
--- a/python/samba/tests/test_pam_winbind.sh
+++ b/python/samba/tests/test_pam_winbind.sh
@@ -12,6 +12,10 @@ PASSWORD="$3"
 export PASSWORD
 shift 3
 
+PAM_OPTIONS="$1"
+export PAM_OPTIONS
+shift 1
+
 PAM_WRAPPER_PATH="$BINDIR/default/third_party/pam_wrapper"
 
 pam_winbind="$BINDIR/shared/pam_winbind.so"
@@ -19,10 +23,10 @@ service_dir="$SELFTEST_TMPDIR/pam_services"
 service_file="$service_dir/samba"
 
 mkdir $service_dir
-echo "auth        required    $pam_winbind debug debug_state" > $service_file
-echo "account     required    $pam_winbind debug debug_state" >> $service_file
-echo "password    required    $pam_winbind debug debug_state" >> $service_file
-echo "session     required    $pam_winbind debug debug_state" >> $service_file
+echo "auth        required    $pam_winbind debug debug_state $PAM_OPTIONS" > $service_file
+echo "account     required    $pam_winbind debug debug_state $PAM_OPTIONS" >> $service_file
+echo "password    required    $pam_winbind debug debug_state $PAM_OPTIONS" >> $service_file
+echo "session     required    $pam_winbind debug debug_state $PAM_OPTIONS" >> $service_file
 
 PAM_WRAPPER="1"
 export PAM_WRAPPER
diff --git a/python/samba/tests/test_pam_winbind_chauthtok.sh b/python/samba/tests/test_pam_winbind_chauthtok.sh
index 5887699300a..48adc81859d 100755
--- a/python/samba/tests/test_pam_winbind_chauthtok.sh
+++ b/python/samba/tests/test_pam_winbind_chauthtok.sh
@@ -53,11 +53,11 @@ PAM_WRAPPER_DEBUGLEVEL=${PAM_WRAPPER_DEBUGLEVEL:="2"}
 export PAM_WRAPPER_DEBUGLEVEL
 
 case $PAM_OPTIONS in
-    use_authtok)
+    *use_authtok*)
         PAM_AUTHTOK="$NEWPASSWORD"
         export PAM_AUTHTOK
     ;;
-    try_authtok)
+    *try_authtok*)
         PAM_AUTHTOK="$NEWPASSWORD"
         export PAM_AUTHTOK
     ;;
diff --git a/python/samba/tests/test_pam_winbind_warn_pwd_expire.sh b/python/samba/tests/test_pam_winbind_warn_pwd_expire.sh
index 16dede44227..348d2ae8387 100755
--- a/python/samba/tests/test_pam_winbind_warn_pwd_expire.sh
+++ b/python/samba/tests/test_pam_winbind_warn_pwd_expire.sh
@@ -12,6 +12,10 @@ PASSWORD="$3"
 export PASSWORD
 shift 3
 
+PAM_OPTIONS="$1"
+export PAM_OPTIONS
+shift 1
+
 PAM_WRAPPER_PATH="$BINDIR/default/third_party/pam_wrapper"
 
 pam_winbind="$BINDIR/shared/pam_winbind.so"
@@ -37,10 +41,10 @@ export PAM_WRAPPER_DEBUGLEVEL
 WARN_PWD_EXPIRE="50"
 export WARN_PWD_EXPIRE
 
-echo "auth        required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" > $service_file
-echo "account     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" >> $service_file
-echo "password    required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" >> $service_file
-echo "session     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" >> $service_file
+echo "auth        required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" > $service_file
+echo "account     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" >> $service_file
+echo "password    required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" >> $service_file
+echo "session     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" >> $service_file
 
 PYTHONPATH="$PYTHONPATH:$PAM_WRAPPER_PATH:$(dirname $0)" $PYTHON -m samba.subunit.run samba.tests.pam_winbind_warn_pwd_expire
 exit_code=$?
@@ -54,10 +58,10 @@ fi
 WARN_PWD_EXPIRE="0"
 export WARN_PWD_EXPIRE
 
-echo "auth        required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" > $service_file
-echo "account     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" >> $service_file
-echo "password    required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" >> $service_file
-echo "session     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE" >> $service_file
+echo "auth        required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" > $service_file
+echo "account     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" >> $service_file
+echo "password    required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" >> $service_file
+echo "session     required    $pam_winbind debug debug_state warn_pwd_expire=$WARN_PWD_EXPIRE $PAM_OPTIONS" >> $service_file
 
 PYTHONPATH="$PYTHONPATH:$PAM_WRAPPER_PATH:$(dirname $0)" $PYTHON -m samba.subunit.run samba.tests.pam_winbind_warn_pwd_expire
 exit_code=$?
diff --git a/selftest/tests.py b/selftest/tests.py
index 7dbc0a9871f..507f7c3ea55 100644
--- a/selftest/tests.py
+++ b/selftest/tests.py
@@ -168,11 +168,11 @@ if with_pam:
     plantestsuite("samba.tests.pam_winbind(local)", "ad_member",
                   [os.path.join(srcdir(), "python/samba/tests/test_pam_winbind.sh"),
                    valgrindify(python), pam_wrapper_so_path,
-                   "$SERVER", "$USERNAME", "$PASSWORD"])
+                   "$SERVER", "$USERNAME", "$PASSWORD", "''"])
     plantestsuite("samba.tests.pam_winbind(domain)", "ad_member",
                   [os.path.join(srcdir(), "python/samba/tests/test_pam_winbind.sh"),
                    valgrindify(python), pam_wrapper_so_path,
-                   "$DOMAIN", "$DC_USERNAME", "$DC_PASSWORD"])
+                   "$DOMAIN", "$DC_USERNAME", "$DC_PASSWORD", "''"])
 
     for pam_options in ["''", "use_authtok", "try_authtok"]:
         plantestsuite("samba.tests.pam_winbind_chauthtok with options %s" % pam_options, "ad_member",
@@ -185,7 +185,7 @@ if with_pam:
     plantestsuite("samba.tests.pam_winbind_warn_pwd_expire(domain)", "ad_member",
                   [os.path.join(srcdir(), "python/samba/tests/test_pam_winbind_warn_pwd_expire.sh"),
                    valgrindify(python), pam_wrapper_so_path,
-                   "$DOMAIN", "alice", "Secret007"])
+                   "$DOMAIN", "alice", "Secret007", "''"])
 
 
 plantestsuite("samba.unittests.krb5samba", "none",