diff --git a/stage1/init/container.go b/stage1/init/container.go
index 6d79cc1..e50bbfe 100644
--- a/stage1/init/container.go
+++ b/stage1/init/container.go
@@ -82,7 +82,7 @@ func LoadContainer(root string) (*Container, error) {
 // quoteExec returns an array of quoted strings appropriate for systemd execStart usage
 func quoteExec(exec []string) string {
 	if len(exec) == 0 {
-		// existing callers prefix {"/diagexec", "/app/root"} so this shouldn't occur.
+		// existing callers prefix {"/diagexec", "/app/root", "/work/dir"} so this shouldn't occur.
 		panic("empty exec")
 	}
 
@@ -111,7 +111,13 @@ func newUnitOption(section, name, value string) *unit.UnitOption {
 func (c *Container) appToSystemd(am *schema.ImageManifest, id types.Hash) error {
 	name := am.Name.String()
 	app := am.App
-	execWrap := []string{"/diagexec", rktpath.RelAppRootfsPath(id)}
+
+	workDir := "/"
+	if app.WorkingDirectory != "" {
+		workDir = app.WorkingDirectory
+	}
+
+	execWrap := []string{"/diagexec", rktpath.RelAppRootfsPath(id), workDir}
 	execStart := quoteExec(append(execWrap, app.Exec...))
 	opts := []*unit.UnitOption{
 		newUnitOption("Unit", "Description", name),
@@ -146,10 +152,6 @@ func (c *Container) appToSystemd(am *schema.ImageManifest, id types.Hash) error
 		opts = append(opts, newUnitOption("Service", "Environment", ee))
 	}
 
-	if app.WorkingDirectory != "" {
-		opts = append(opts, newUnitOption("Service", "WorkingDirectory", app.WorkingDirectory))
-	}
-
 	saPorts := []types.Port{}
 	for _, p := range app.Ports {
 		if p.SocketActivated {
diff --git a/stage1/rootfs/diagexec/diagexec.c b/stage1/rootfs/diagexec/diagexec.c
index 0d25673..5569cec 100644
--- a/stage1/rootfs/diagexec/diagexec.c
+++ b/stage1/rootfs/diagexec/diagexec.c
@@ -139,14 +139,15 @@ static void diag(const char *exe)
 
 int main(int argc, char *argv[])
 {
-	const char *root, *exe;
-	exit_if(argc < 3,
-		"Usage: %s /path/to/root /to/exec [args ...]", argv[0]);
+	const char *root, *cwd, *exe;
+	exit_if(argc < 4,
+		"Usage: %s /path/to/root /work/directory /to/exec [args ...]", argv[0]);
 	root = argv[1];
-	exe = argv[2];
-	pexit_if(chroot(root) == -1, "Chroot failed");
-	pexit_if(chdir("/") == -1, "Chdir failed");
-	pexit_if(execvp(exe, &argv[2]) == -1 &&
+	cwd = argv[2];
+	exe = argv[3];
+	pexit_if(chroot(root) == -1, "Chroot \"%s\" failed", root);
+	pexit_if(chdir(cwd) == -1, "Chdir \"%s\" failed", cwd);
+	pexit_if(execvp(exe, &argv[3]) == -1 &&
 		 errno != ENOENT && errno != EACCES,
 		 "Exec of \"%s\" failed", exe);
 	diag(exe);
diff --git a/stage1/rootfs/enter/enter.c b/stage1/rootfs/enter/enter.c
index 4675d50..0508bfd 100644
--- a/stage1/rootfs/enter/enter.c
+++ b/stage1/rootfs/enter/enter.c
@@ -90,7 +90,7 @@ int main(int argc, char *argv[])
 
 	if(child == 0) {
 		char		path[PATH_MAX];
-		char		*args[argc + 1];
+		char		*args[argc + 2];
 		int		i;
 
 		/* Child goes on to execute /diagexec */
@@ -101,10 +101,11 @@ int main(int argc, char *argv[])
 
 		args[0] = "/diagexec";
 		args[1] = path;
+		args[2] = "/";	/* TODO(vc): plumb this into app.WorkingDirectory */
 		for(i = 2; i < argc; i++) {
-			args[i] = argv[i];
+			args[i + 1] = argv[i];
 		}
-		args[i] = NULL;
+		args[i + 1] = NULL;
 
 		exit_if(execv(args[0], args) == -1,
 			"exec failed");