diff --git a/run-tests.sh b/run-tests.sh
index f9cdaa72..8d338976 100755
--- a/run-tests.sh
+++ b/run-tests.sh
@@ -208,6 +208,8 @@ run_tests() {
   else # Run all tests for other backends
     run_tests_in_folder "tests/_exe"
   fi
+  # Folder containing tests that expose bugs in pnut or shells
+  run_tests_in_folder "tests/_bug"
 
   echo "Summary:"
   echo "===================="
diff --git a/tests/_bug/negative-zero.c b/tests/_bug/negative-zero.c
new file mode 100644
index 00000000..45398696
--- /dev/null
+++ b/tests/_bug/negative-zero.c
@@ -0,0 +1,26 @@
+// On ksh, when assigning the negative value of a variable containing 0 (i.e.
+// -0) to a variable using arithmetic expansion, the variable is assigned the
+// string `-0` instead of 0. Other shells assign 0 as expected.
+
+// expect_failure_for: ksh
+int return0() {
+  int a = 0;
+  return -a;
+}
+
+void putstring(char *s) {
+	while (*s) {
+		putchar(*s);
+		s = s + 1;
+	}
+}
+
+void main() {
+  // Workaround: use `return0() + 0 == 0`.
+  // This forces the result of return0 to be in an arithmetic expansion which removes the `-` from `-0`.
+  if (return0() == 0) {
+    putstring("zero\n");
+  } else {
+    putstring("non-zero\n");
+  }
+}
diff --git a/tests/_bug/negative-zero.golden b/tests/_bug/negative-zero.golden
new file mode 100644
index 00000000..26af6a86
--- /dev/null
+++ b/tests/_bug/negative-zero.golden
@@ -0,0 +1 @@
+zero