diff --git a/httpd/httpd.c b/httpd/httpd.c
index 5e92d05b..efba40c0 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -21,6 +21,7 @@
 
 extern volatile __xdata uint8_t sfr_data[4];
 extern volatile __xdata uint32_t ticks;
+extern __xdata uint8_t cmd_capture;	/* owned by rtlplayground.c, see write_char() */
 extern __code uint8_t * __code hex;
 extern __code struct f_data f_data[];
 extern __code char * __code mime_strings[];
@@ -625,12 +626,15 @@ static void handle_firmware_fragment(__xdata uint8_t *p)
 
 static void run_cmd_body(__xdata uint8_t *body)
 {
+	slen = strtox(outbuf, "HTTP/1.1 200 OK\r\nConnection: close\r\n" \
+			      "Content-Type: text/plain\r\n\r\n");
+	cmd_capture = 1;
 	execute_commands(body);
+	cmd_capture = 0;
 	if (err_status != ERR_OK) {
 		send_bad_request();
 		return;
 	}
-	send_ok();
 }
 
 
diff --git a/rtlplayground.c b/rtlplayground.c
index 70b8582b..aa41d9e8 100644
--- a/rtlplayground.c
+++ b/rtlplayground.c
@@ -240,6 +240,12 @@ void isr_serial(void) __interrupt(4)
 }
 
 
+/* Set by the httpd while it runs a command that arrived over the network, so
+ * that everything the command prints lands in the response as well. */
+__xdata uint8_t cmd_capture;
+extern __xdata uint8_t outbuf[TCP_OUTBUF_SIZE];
+extern __xdata uint16_t slen;
+
 void write_char_no_syslog(char c)
 {
 	do {
@@ -256,6 +262,9 @@ void write_char_no_syslog(char c)
 
 void write_char(char c)
 {
+	if (cmd_capture && slen < TCP_OUTBUF_SIZE - 1)
+		outbuf[slen++] = c;
+
 	write_char_no_syslog(c);
 
 	if (syslog_state.enabled) {