diff --git a/src/uu/chroot/src/chroot.rs b/src/uu/chroot/src/chroot.rs
index 40799d009..55097c1bb 100644
--- a/src/uu/chroot/src/chroot.rs
+++ b/src/uu/chroot/src/chroot.rs
@@ -67,7 +67,7 @@ pub fn uumain(args: impl uucore::Args) -> i32 {
     // TODO: refactor the args and command matching
     // See: https://github.com/uutils/coreutils/pull/2365#discussion_r647849967
     let command: Vec<&str> = match commands.len() {
-        1 => {
+        0 => {
             let shell: &str = match user_shell {
                 Err(_) => default_shell,
                 Ok(ref s) => s.as_ref(),
@@ -77,12 +77,28 @@ pub fn uumain(args: impl uucore::Args) -> i32 {
         _ => commands,
     };
 
+    assert!(!command.is_empty());
+    let chroot_command = command[0];
+    let chroot_args = &command[1..];
+
+    // NOTE: Tests can only trigger code beyond this point if they're invoked with root permissions
     set_context(newroot, &matches);
 
-    let pstatus = Command::new(command[0])
-        .args(&command[1..])
+    let pstatus = Command::new(chroot_command)
+        .args(chroot_args)
         .status()
-        .unwrap_or_else(|e| crash!(1, "Cannot exec: {}", e));
+        .unwrap_or_else(|e| {
+            // TODO: Exit status:
+            // 125 if chroot itself fails
+            // 126 if command is found but cannot be invoked
+            // 127 if command cannot be found
+            crash!(
+                1,
+                "failed to run command {}: {}",
+                command[0].to_string().quote(),
+                e
+            )
+        });
 
     if pstatus.success() {
         0
diff --git a/tests/by-util/test_chroot.rs b/tests/by-util/test_chroot.rs
index 65d821d01..3e5c22679 100644
--- a/tests/by-util/test_chroot.rs
+++ b/tests/by-util/test_chroot.rs
@@ -15,6 +15,7 @@ fn test_missing_operand() {
 
 #[test]
 fn test_enter_chroot_fails() {
+    // NOTE: since #2689 this test also ensures that we don't regress #2687
     let (at, mut ucmd) = at_and_ucmd!();
 
     at.mkdir("jail");
@@ -89,3 +90,26 @@ fn test_preference_of_userspec() {
     println!("result.stdout = {}", result.stdout_str());
     println!("result.stderr = {}", result.stderr_str());
 }
+
+#[test]
+fn test_default_shell() {
+    // NOTE: This test intends to trigger code which can only be reached with root permissions.
+    let ts = TestScenario::new(util_name!());
+    let at = &ts.fixtures;
+
+    let dir = "CHROOT_DIR";
+    at.mkdir(dir);
+
+    let shell = std::env::var("SHELL").unwrap_or_else(|_| "/bin/sh".to_string());
+    let _expected = format!(
+        "chroot: failed to run command '{}': No such file or directory",
+        shell
+    );
+
+    // TODO: [2021-09; jhscheer] uncomment if/when #2692 gets merged
+    // if let Ok(result) = run_ucmd_as_root(&ts, &[dir]) {
+    //     result.stderr_contains(expected);
+    // } else {
+    //     print!("TEST SKIPPED");
+    // }
+}