diff --git a/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/Program.cs b/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/Program.cs
new file mode 100644
index 00000000000..e9708d0b5d2
--- /dev/null
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/Program.cs
@@ -0,0 +1 @@
+Console.WriteLine(args[0]);
diff --git a/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/dotnet_build.csproj b/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/dotnet_build.csproj
new file mode 100644
index 00000000000..f02677bf640
--- /dev/null
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/dotnet_build.csproj
@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net7.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+</Project>
diff --git a/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/test.py b/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/test.py
new file mode 100644
index 00000000000..0f2584104eb
--- /dev/null
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_no_args_inject/test.py
@@ -0,0 +1,9 @@
+from create_database_utils import *
+from diagnostics_test_utils import *
+
+# the tracer configuration should not inject the extra command-line arguments for these commands
+# and they should therefore run successfully
+run_codeql_database_init(lang="csharp")
+# this command fails on Windows for some reason, so we comment it out for now
+# run_codeql_database_trace_command(['dotnet', 'tool', 'search', 'publish'])
+run_codeql_database_trace_command(['dotnet', 'new', 'console', '--force', '--name', 'build', '--output', '.'])
diff --git a/csharp/tools/tracing-config.lua b/csharp/tools/tracing-config.lua
index f04169caff5..68b7b816ffe 100644
--- a/csharp/tools/tracing-config.lua
+++ b/csharp/tools/tracing-config.lua
@@ -24,6 +24,10 @@ function RegisterExtractorPack(id)
         local testMatch = false
         local dotnetRunNeedsSeparator = false;
         local dotnetRunInjectionIndex = nil;
+        -- A flag indicating whether we are in a position where we expect a sub-command such as `build`.
+        -- Once we have found one, we set this to `false` to not accidentally pick up on things that
+        -- look like sub-command names later on in the argument vector.
+        local inSubCommandPosition = true;
         local argv = compilerArguments.argv
         if OperatingSystem == 'windows' then
             -- let's hope that this split matches the escaping rules `dotnet` applies to command line arguments
@@ -35,30 +39,38 @@ function RegisterExtractorPack(id)
             -- dotnet options start with either - or / (both are legal)
             local firstCharacter = string.sub(arg, 1, 1)
             if not (firstCharacter == '-') and not (firstCharacter == '/') then
-                if (not match) then
+                if (not match) and inSubCommandPosition then
                     Log(1, 'Dotnet subcommand detected: %s', arg)
                 end
-                if arg == 'build' or arg == 'msbuild' or arg == 'publish' or arg == 'pack' then
-                    match = true
-                    break
-                end
-                if arg == 'run' then
-                    -- for `dotnet run`, we need to make sure that `-p:UseSharedCompilation=false` is
-                    -- not passed in as an argument to the program that is run
-                    match = true
-                    dotnetRunNeedsSeparator = true
-                    dotnetRunInjectionIndex = i + 1
-                end
-                if arg == 'test' then
-                    match = true
-                    testMatch = true
+                -- only respond to strings that look like sub-command names if we have not yet
+                -- encountered something that looks like a sub-command
+                if inSubCommandPosition then
+                    if arg == 'build' or arg == 'msbuild' or arg == 'publish' or arg == 'pack' then
+                        match = true
+                        break
+                    end
+                    if arg == 'run' then
+                        -- for `dotnet run`, we need to make sure that `-p:UseSharedCompilation=false` is
+                        -- not passed in as an argument to the program that is run
+                        match = true
+                        dotnetRunNeedsSeparator = true
+                        dotnetRunInjectionIndex = i + 1
+                    end
+                    if arg == 'test' then
+                        match = true
+                        testMatch = true
+                    end
                 end
+
                 -- for `dotnet test`, we should not append `-p:UseSharedCompilation=false` to the command line
                 -- if an `exe` or `dll` is passed as an argument as the call is forwarded to vstest.
                 if testMatch and (arg:match('%.exe$') or arg:match('%.dll'))  then
                     match = false
                     break
                 end
+
+                -- we have found a sub-command, ignore all strings that look like sub-command names from now on
+                inSubCommandPosition = false
             end
             -- if we see a separator to `dotnet run`, inject just prior to the existing separator
             if arg == '--' then