diff --git a/bin/moshcode.mjs b/bin/moshcode.mjs
index f095889..c591fc3 100755
--- a/bin/moshcode.mjs
+++ b/bin/moshcode.mjs
@@ -44,6 +44,9 @@ function readScript(arg) {
 
 function parseMax(value) {
   if (value === undefined) throw new Error("moshcode run: --max requires a positive integer");
+  if (!/^\d+$/.test(String(value))) {
+    throw new Error(`moshcode run: --max must be a positive integer, got ${JSON.stringify(value)}`);
+  }
   const max = Number(value);
   if (!Number.isInteger(max) || max < 1) {
     throw new Error(`moshcode run: --max must be a positive integer, got ${JSON.stringify(value)}`);
diff --git a/test/run-options.test.mjs b/test/run-options.test.mjs
index 04004e2..a035596 100644
--- a/test/run-options.test.mjs
+++ b/test/run-options.test.mjs
@@ -82,6 +82,15 @@ test("run accepts equals-form max option", async () => {
   assert.match(result.stdout, /1 loop\(s\)/);
 });
 
+test("run rejects non-decimal max values", async () => {
+  for (const value of ["1e1", "0x2"]) {
+    const result = await run([`--max=${value}`, "--dry-run"]);
+
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /moshcode run: --max must be a positive integer/);
+  }
+});
+
 test("run() marks the nested moshcode child as nested", async () => {
   const dir = mkdtempSync(join(tmpdir(), "moshcode-nested-"));
   const child = join(dir, "child.mosh");