diff --git a/CHANGES b/CHANGES
index b2c41af80d..a90f9ace66 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+8.0.0-dev.410 | 2025-06-09 18:00:33 -0700
+
+  * Btests: don't use -C in Zeek invocations that don't actually need it (Christian Kreibich, Corelight)
+
+  * Remove executable file permission bits from a bunch of our pcaps (Christian Kreibich, Corelight)
+
 8.0.0-dev.406 | 2025-06-06 11:45:33 -0700
 
   * Move initialization of RandTest members to header (Tim Wojtulewicz, Corelight)
diff --git a/VERSION b/VERSION
index 1fb077a4b5..e9b208c9d8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.0-dev.406
+8.0.0-dev.410
diff --git a/testing/btest/Traces/dnp3/dnp3_link_only.pcap b/testing/btest/Traces/dnp3/dnp3_link_only.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/dnp3/dnp3_udp_en_spon.pcap b/testing/btest/Traces/dnp3/dnp3_udp_en_spon.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/dnp3/dnp3_udp_read.pcap b/testing/btest/Traces/dnp3/dnp3_udp_read.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/dnp3/dnp3_udp_select_operate.pcap b/testing/btest/Traces/dnp3/dnp3_udp_select_operate.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/dnp3/dnp3_udp_write.pcap b/testing/btest/Traces/dnp3/dnp3_udp_write.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/http/content-range-less-than-len.pcap b/testing/btest/Traces/http/content-range-less-than-len.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/http/fake-content-length.pcap b/testing/btest/Traces/http/fake-content-length.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/http/x-gzip.pcap b/testing/btest/Traces/http/x-gzip.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/ipv6-fragmented-dns.trace b/testing/btest/Traces/ipv6-fragmented-dns.trace
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/ipv6-mobility-dst-opts.trace b/testing/btest/Traces/ipv6-mobility-dst-opts.trace
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/krb/optional-service-name.pcap b/testing/btest/Traces/krb/optional-service-name.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/krb/smb2_krb.pcap b/testing/btest/Traces/krb/smb2_krb.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/krb/smb_gssapi.trace b/testing/btest/Traces/krb/smb_gssapi.trace
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/modbus/4SICS-GeekLounge-151022-min.pcap b/testing/btest/Traces/modbus/4SICS-GeekLounge-151022-min.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/syslog-missing-pri.trace b/testing/btest/Traces/syslog-missing-pri.trace
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp10_not_0xff.pcap b/testing/btest/Traces/tunnels/gtp/gtp10_not_0xff.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp1_gn_normal_incl_fragmentation.pcap b/testing/btest/Traces/tunnels/gtp/gtp1_gn_normal_incl_fragmentation.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp2_different_udp_port.pcap b/testing/btest/Traces/tunnels/gtp/gtp2_different_udp_port.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp3_false_gtp.pcap b/testing/btest/Traces/tunnels/gtp/gtp3_false_gtp.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp4_udp_2152_inside.pcap b/testing/btest/Traces/tunnels/gtp/gtp4_udp_2152_inside.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp6_gtp_0x32.pcap b/testing/btest/Traces/tunnels/gtp/gtp6_gtp_0x32.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp7_ipv6.pcap b/testing/btest/Traces/tunnels/gtp/gtp7_ipv6.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp8_teredo.pcap b/testing/btest/Traces/tunnels/gtp/gtp8_teredo.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/Traces/tunnels/gtp/gtp9_unknown_or_too_short_payload.pcap b/testing/btest/Traces/tunnels/gtp/gtp9_unknown_or_too_short_payload.pcap
old mode 100755
new mode 100644
diff --git a/testing/btest/core/erspan.zeek b/testing/btest/core/erspan.zeek
index 379afb55fb..0a3bf60311 100644
--- a/testing/btest/core/erspan.zeek
+++ b/testing/btest/core/erspan.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/erspan.trace %INPUT 
+# @TEST-EXEC: zeek -b -r $TRACES/erspan.trace %INPUT
 # @TEST-EXEC: btest-diff tunnel.log
 
 @load base/frameworks/tunnels
diff --git a/testing/btest/core/erspanI.zeek b/testing/btest/core/erspanI.zeek
index 15336c8853..c265613352 100644
--- a/testing/btest/core/erspanI.zeek
+++ b/testing/btest/core/erspanI.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/erspanI.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/erspanI.pcap %INPUT
 # @TEST-EXEC: btest-diff tunnel.log
 # @TEST-EXEC: btest-diff conn.log
 
diff --git a/testing/btest/core/erspanII.zeek b/testing/btest/core/erspanII.zeek
index 945a8ff3d2..1c128a70c4 100644
--- a/testing/btest/core/erspanII.zeek
+++ b/testing/btest/core/erspanII.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/erspanII.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/erspanII.pcap %INPUT
 # @TEST-EXEC: btest-diff tunnel.log
 # @TEST-EXEC: btest-diff conn.log
 
diff --git a/testing/btest/core/erspanIII.zeek b/testing/btest/core/erspanIII.zeek
index de3072e022..6d15f1a2a6 100644
--- a/testing/btest/core/erspanIII.zeek
+++ b/testing/btest/core/erspanIII.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/erspanIII.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/erspanIII.pcap %INPUT
 # @TEST-EXEC: btest-diff tunnel.log
 # @TEST-EXEC: btest-diff conn.log
 
diff --git a/testing/btest/core/ether-addrs.zeek b/testing/btest/core/ether-addrs.zeek
index d905d97baa..7a0de6bfc7 100644
--- a/testing/btest/core/ether-addrs.zeek
+++ b/testing/btest/core/ether-addrs.zeek
@@ -1,5 +1,5 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/wikipedia.trace %INPUT >>output
-# @TEST-EXEC: zeek -C -b -r $TRACES/radiotap.pcap %INPUT >>output
+# @TEST-EXEC: zeek -b -r $TRACES/wikipedia.trace %INPUT >>output
+# @TEST-EXEC: zeek -b -r $TRACES/radiotap.pcap %INPUT >>output
 # @TEST-EXEC: btest-diff output
 
 event new_connection(c: connection)
diff --git a/testing/btest/core/pcap/read-trace-with-filter.zeek b/testing/btest/core/pcap/read-trace-with-filter.zeek
index ba9db2c2a4..41c42a9fed 100644
--- a/testing/btest/core/pcap/read-trace-with-filter.zeek
+++ b/testing/btest/core/pcap/read-trace-with-filter.zeek
@@ -1,3 +1,3 @@
-# @TEST-EXEC: zeek -C -r $TRACES/wikipedia.trace -f "port 50000"
+# @TEST-EXEC: zeek -r $TRACES/wikipedia.trace -f "port 50000"
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff packet_filter.log
diff --git a/testing/btest/core/pppoe-over-qinq.zeek b/testing/btest/core/pppoe-over-qinq.zeek
index 1b31694f15..a0a12e490b 100644
--- a/testing/btest/core/pppoe-over-qinq.zeek
+++ b/testing/btest/core/pppoe-over-qinq.zeek
@@ -1,5 +1,5 @@
 # Disable test temporarily - see GH-4547
 # @TEST-REQUIRES: ! have-spicy-ssl
 
-# @TEST-EXEC: zeek -C -r $TRACES/pppoe-over-qinq.pcap
+# @TEST-EXEC: zeek -r $TRACES/pppoe-over-qinq.pcap
 # @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/core/reporter-weird-sampling-global.zeek b/testing/btest/core/reporter-weird-sampling-global.zeek
index c2e75b31df..7698b34ff9 100644
--- a/testing/btest/core/reporter-weird-sampling-global.zeek
+++ b/testing/btest/core/reporter-weird-sampling-global.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/wlanmon.pcap %INPUT | sort | uniq -c | awk '{print $1, $2, $3}' >output
+# @TEST-EXEC: zeek -b -r $TRACES/wlanmon.pcap %INPUT | sort | uniq -c | awk '{print $1, $2, $3}' >output
 # @TEST-EXEC: btest-diff output
 
 # The sampling functionality itself is already tested through other tests.
diff --git a/testing/btest/core/tunnels/gre-aruba-amsdu.zeek b/testing/btest/core/tunnels/gre-aruba-amsdu.zeek
index 975c96a871..2834d3063d 100644
--- a/testing/btest/core/tunnels/gre-aruba-amsdu.zeek
+++ b/testing/btest/core/tunnels/gre-aruba-amsdu.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Tests a GRE ARUBA trace that contains IEEE 802.11 QoS A-MSDU headers. This is testing that the tunnel is detected and that the conn byte size contains both A-MSDU subframe packets.
-# @TEST-EXEC: zeek -C -b -r $TRACES/tunnels/gre-aruba-amsdu.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/tunnels/gre-aruba-amsdu.pcap %INPUT
 # @TEST-EXEC: btest-diff tunnel.log
 # @TEST-EXEC: btest-diff conn.log
 
diff --git a/testing/btest/core/tunnels/gre-aruba-ccmp.zeek b/testing/btest/core/tunnels/gre-aruba-ccmp.zeek
index 3f095ab6a1..65baecaeb5 100644
--- a/testing/btest/core/tunnels/gre-aruba-ccmp.zeek
+++ b/testing/btest/core/tunnels/gre-aruba-ccmp.zeek
@@ -1,4 +1,4 @@
 # @TEST-DOC: Tests a GRE ARUBA trace that contains IEEE 802.11 CCMP headers. This should report a weird about encrypted data.
-# @TEST-EXEC: zeek -C -b -r $TRACES/tunnels/gre-aruba-ccmp.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/tunnels/gre-aruba-ccmp.pcap %INPUT
 
 @load base/frameworks/notice/weird
diff --git a/testing/btest/core/tunnels/gre-aruba.zeek b/testing/btest/core/tunnels/gre-aruba.zeek
index 5df8396377..2544b20587 100644
--- a/testing/btest/core/tunnels/gre-aruba.zeek
+++ b/testing/btest/core/tunnels/gre-aruba.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/tunnels/gre-aruba.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/tunnels/gre-aruba.pcap %INPUT
 # @TEST-EXEC: btest-diff tunnel.log
 
 @load base/frameworks/tunnels
diff --git a/testing/btest/core/tunnels/gre-in-gre-min-depth.test b/testing/btest/core/tunnels/gre-in-gre-min-depth.test
index 9ffd1e0661..ad6ce766f8 100644
--- a/testing/btest/core/tunnels/gre-in-gre-min-depth.test
+++ b/testing/btest/core/tunnels/gre-in-gre-min-depth.test
@@ -1,3 +1,3 @@
 # @TEST-DOC: Tests that an IP-in-IP tunnel with max-depth set to 1 doesn't crash
-# @TEST-EXEC: zeek -C -r $TRACES/tunnels/gre-within-gre.pcap Tunnel::max_depth=1
+# @TEST-EXEC: zeek -r $TRACES/tunnels/gre-within-gre.pcap Tunnel::max_depth=1
 # @TEST-EXEC: btest-diff weird.log
\ No newline at end of file
diff --git a/testing/btest/core/tunnels/gtp/unknown_or_too_short.test b/testing/btest/core/tunnels/gtp/unknown_or_too_short.test
index 6a188f2177..21de4e7104 100644
--- a/testing/btest/core/tunnels/gtp/unknown_or_too_short.test
+++ b/testing/btest/core/tunnels/gtp/unknown_or_too_short.test
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -r $TRACES/tunnels/gtp/gtp9_unknown_or_too_short_payload.pcap %INPUT
+# @TEST-EXEC: zeek -r $TRACES/tunnels/gtp/gtp9_unknown_or_too_short_payload.pcap %INPUT
 # @TEST-EXEC: btest-diff analyzer.log
 # @TEST-EXEC: btest-diff tunnel.log
 
diff --git a/testing/btest/scripts/base/frameworks/file-analysis/bifs/enable-disable.zeek b/testing/btest/scripts/base/frameworks/file-analysis/bifs/enable-disable.zeek
index 0e8f92adad..1ac777e50a 100644
--- a/testing/btest/scripts/base/frameworks/file-analysis/bifs/enable-disable.zeek
+++ b/testing/btest/scripts/base/frameworks/file-analysis/bifs/enable-disable.zeek
@@ -1,5 +1,5 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/pe/pe.trace %INPUT >out
-# @TEST-EXEC: zeek -C -b -r $TRACES/pe/pe.trace %INPUT disable_it=T >>out
+# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT >out
+# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT disable_it=T >>out
 # @TEST-EXEC: btest-diff out
 
 @load base/protocols/ftp
diff --git a/testing/btest/scripts/base/frameworks/storage/redis-expiration.zeek b/testing/btest/scripts/base/frameworks/storage/redis-expiration.zeek
index 2951838c9c..7be028e0e8 100644
--- a/testing/btest/scripts/base/frameworks/storage/redis-expiration.zeek
+++ b/testing/btest/scripts/base/frameworks/storage/redis-expiration.zeek
@@ -4,7 +4,7 @@
 # @TEST-PORT: REDIS_PORT
 
 # @TEST-EXEC: btest-bg-run redis-server run-redis-server ${REDIS_PORT%/tcp}
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -B storage -b -Cr - %INPUT > out
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -B storage -b -r - %INPUT > out
 # @TEST-EXEC: btest-bg-wait -k 1
 
 # @TEST-EXEC: btest-diff out
diff --git a/testing/btest/scripts/base/frameworks/storage/sqlite-basic-reading-pcap.zeek b/testing/btest/scripts/base/frameworks/storage/sqlite-basic-reading-pcap.zeek
index 38ac20234b..a4b6e99bef 100644
--- a/testing/btest/scripts/base/frameworks/storage/sqlite-basic-reading-pcap.zeek
+++ b/testing/btest/scripts/base/frameworks/storage/sqlite-basic-reading-pcap.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Tests that sqlite async works fine while reading pcaps
-# @TEST-EXEC: zeek -C -r $TRACES/http/get.trace %INPUT > out
+# @TEST-EXEC: zeek -r $TRACES/http/get.trace %INPUT > out
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
 
diff --git a/testing/btest/scripts/base/frameworks/storage/sqlite-expiration.zeek b/testing/btest/scripts/base/frameworks/storage/sqlite-expiration.zeek
index 27b89e1f02..621859db11 100644
--- a/testing/btest/scripts/base/frameworks/storage/sqlite-expiration.zeek
+++ b/testing/btest/scripts/base/frameworks/storage/sqlite-expiration.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Automatic expiration of stored data
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -r - %INPUT > out
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
 
diff --git a/testing/btest/scripts/base/frameworks/telemetry/basic.zeek b/testing/btest/scripts/base/frameworks/telemetry/basic.zeek
index 14b7ea9904..3c6c2f8f2c 100644
--- a/testing/btest/scripts/base/frameworks/telemetry/basic.zeek
+++ b/testing/btest/scripts/base/frameworks/telemetry/basic.zeek
@@ -2,7 +2,7 @@
 # Not compilable to C++ due to globals being initialized to a record that
 # has an opaque type as a field.
 # @TEST-REQUIRES: test "${ZEEK_USE_CPP}" != "1"
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -r - %INPUT > out
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC-FAIL: test -f reporter.log
 
diff --git a/testing/btest/scripts/base/frameworks/telemetry/conn-duration-histogram.zeek b/testing/btest/scripts/base/frameworks/telemetry/conn-duration-histogram.zeek
index c7ab5651fa..a99d75e6c6 100644
--- a/testing/btest/scripts/base/frameworks/telemetry/conn-duration-histogram.zeek
+++ b/testing/btest/scripts/base/frameworks/telemetry/conn-duration-histogram.zeek
@@ -1,7 +1,7 @@
 # Not compilable to C++ due to globals being initialized to a record that
 # has an opaque type as a field.
 # @TEST-REQUIRES: test "${ZEEK_USE_CPP}" != "1"
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -r - %INPUT > out
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC-FAIL: test -f reporter.log
 
diff --git a/testing/btest/scripts/base/frameworks/telemetry/event-handler-invocations.zeek b/testing/btest/scripts/base/frameworks/telemetry/event-handler-invocations.zeek
index 7fd72f92b3..451b0d686b 100644
--- a/testing/btest/scripts/base/frameworks/telemetry/event-handler-invocations.zeek
+++ b/testing/btest/scripts/base/frameworks/telemetry/event-handler-invocations.zeek
@@ -3,7 +3,7 @@
 # Not compilable to C++ due to globals being initialized to a record that
 # has an opaque type as a field.
 # @TEST-REQUIRES: test "${ZEEK_USE_CPP}" != "1"
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -r - %INPUT > out
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC-FAIL: test -f reporter.log
 
diff --git a/testing/btest/scripts/base/frameworks/telemetry/internal-metrics.zeek b/testing/btest/scripts/base/frameworks/telemetry/internal-metrics.zeek
index 0c98d40e1c..70731884b3 100644
--- a/testing/btest/scripts/base/frameworks/telemetry/internal-metrics.zeek
+++ b/testing/btest/scripts/base/frameworks/telemetry/internal-metrics.zeek
@@ -2,7 +2,7 @@
 # Not compilable to C++ due to globals being initialized to a record that
 # has an opaque type as a field.
 # @TEST-REQUIRES: test "${ZEEK_USE_CPP}" != "1"
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -r - %INPUT > out
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC-FAIL: test -f reporter.log
 
diff --git a/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-discard.zeek b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-discard.zeek
index 05b7fb39f9..5005f2bd3d 100644
--- a/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-discard.zeek
+++ b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-discard.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Pcap does not contain close requests for the involved fids (filtered out with wireshark)
-# @TEST-EXEC: zeek -C -r $TRACES/dce-rpc/20-fids-no-close.pcap %INPUT >out
+# @TEST-EXEC: zeek -r $TRACES/dce-rpc/20-fids-no-close.pcap %INPUT >out
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC: btest-diff weird.log
 
diff --git a/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-size.zeek b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-size.zeek
index 8b5dbb6432..77287cc4b1 100644
--- a/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-size.zeek
+++ b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-size.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Ensure dce_rpc_backing state stays bounded when pipes are closed properly.
-# @TEST-EXEC: zeek -C -r $TRACES/dce-rpc/20-fids.pcap %INPUT >out
+# @TEST-EXEC: zeek -r $TRACES/dce-rpc/20-fids.pcap %INPUT >out
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC: test ! -f weird.log
 
diff --git a/testing/btest/scripts/base/protocols/dns/dns-edns-cookie.zeek b/testing/btest/scripts/base/protocols/dns/dns-edns-cookie.zeek
index abf69cc49e..67392746b8 100644
--- a/testing/btest/scripts/base/protocols/dns/dns-edns-cookie.zeek
+++ b/testing/btest/scripts/base/protocols/dns/dns-edns-cookie.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -r $TRACES/dns-edns-cookie.pcap %INPUT > output
+# @TEST-EXEC: zeek -r $TRACES/dns-edns-cookie.pcap %INPUT > output
 # @TEST-EXEC: btest-diff output
 @load policy/protocols/dns/auth-addl
 
diff --git a/testing/btest/scripts/base/protocols/dns/dns-edns-tcp-keepalive.zeek b/testing/btest/scripts/base/protocols/dns/dns-edns-tcp-keepalive.zeek
index 2291bc68fe..122f51ba87 100644
--- a/testing/btest/scripts/base/protocols/dns/dns-edns-tcp-keepalive.zeek
+++ b/testing/btest/scripts/base/protocols/dns/dns-edns-tcp-keepalive.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -r $TRACES/dns-edns-tcp-keepalive.pcap %INPUT > output
+# @TEST-EXEC: zeek -r $TRACES/dns-edns-tcp-keepalive.pcap %INPUT > output
 # @TEST-EXEC: btest-diff output
 @load policy/protocols/dns/auth-addl
 
diff --git a/testing/btest/scripts/base/protocols/dns/https.zeek b/testing/btest/scripts/base/protocols/dns/https.zeek
index d7e9fa0590..5fcc42ec97 100644
--- a/testing/btest/scripts/base/protocols/dns/https.zeek
+++ b/testing/btest/scripts/base/protocols/dns/https.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -r $TRACES/dns-https.pcap %INPUT > output
+# @TEST-EXEC: zeek -r $TRACES/dns-https.pcap %INPUT > output
 # @TEST-EXEC: btest-diff output
 
 @load policy/protocols/dns/auth-addl
diff --git a/testing/btest/scripts/base/protocols/http/curl-http-09.zeek b/testing/btest/scripts/base/protocols/http/curl-http-09.zeek
index 4c4a427675..1bb835e3bf 100644
--- a/testing/btest/scripts/base/protocols/http/curl-http-09.zeek
+++ b/testing/btest/scripts/base/protocols/http/curl-http-09.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: curl --http0.9 to accept the headerless response.
-# @TEST-EXEC: zeek -b -Cr $TRACES/http/curl_http_09.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/http/curl_http_09.pcap %INPUT
 # @TEST-EXEC: btest-diff http.log
 # @TEST-EXEC: test ! -f weird.log
 
diff --git a/testing/btest/scripts/base/protocols/http/http-09.zeek b/testing/btest/scripts/base/protocols/http/http-09.zeek
index 0a7f368fb2..96bdb67f09 100644
--- a/testing/btest/scripts/base/protocols/http/http-09.zeek
+++ b/testing/btest/scripts/base/protocols/http/http-09.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Artificially created PCAP with one proper HTTP 0.9 request/response and a few invalid ones.
-# @TEST-EXEC: zeek -b -Cr $TRACES/http/http_09.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/http/http_09.pcap %INPUT
 # @TEST-EXEC: btest-diff http.log
 # @TEST-EXEC: btest-diff weird.log
 
diff --git a/testing/btest/scripts/base/protocols/http/http-dpd-large-req.zeek b/testing/btest/scripts/base/protocols/http/http-dpd-large-req.zeek
index 557fe29d29..1161cc0523 100644
--- a/testing/btest/scripts/base/protocols/http/http-dpd-large-req.zeek
+++ b/testing/btest/scripts/base/protocols/http/http-dpd-large-req.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/http/http_large_req_8001.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r $TRACES/http/http_large_req_8001.pcap %INPUT >output
 # @TEST-EXEC: btest-diff output
 # 
 # @TEST-DOC: Tests our DPD signatures with a session where one side exceeds the DPD buffer size.
diff --git a/testing/btest/scripts/base/protocols/http/no-version.zeek b/testing/btest/scripts/base/protocols/http/no-version.zeek
index 24a27e2a04..82f097385f 100644
--- a/testing/btest/scripts/base/protocols/http/no-version.zeek
+++ b/testing/btest/scripts/base/protocols/http/no-version.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -b -Cr $TRACES/http/no-version.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/http/no-version.pcap %INPUT
 # @TEST-EXEC: btest-diff http.log
 
 @load base/protocols/http
diff --git a/testing/btest/scripts/base/protocols/http/percent-end-of-line.zeek b/testing/btest/scripts/base/protocols/http/percent-end-of-line.zeek
index a80e9be719..bdce61dc42 100644
--- a/testing/btest/scripts/base/protocols/http/percent-end-of-line.zeek
+++ b/testing/btest/scripts/base/protocols/http/percent-end-of-line.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -b -Cr $TRACES/http/percent-end-of-line.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/http/percent-end-of-line.pcap %INPUT
 # @TEST-EXEC: btest-diff http.log
 # @TEST-EXEC: btest-diff weird.log
 
diff --git a/testing/btest/scripts/base/protocols/http/version-mismatch.zeek b/testing/btest/scripts/base/protocols/http/version-mismatch.zeek
index 9929122053..552fbd211e 100644
--- a/testing/btest/scripts/base/protocols/http/version-mismatch.zeek
+++ b/testing/btest/scripts/base/protocols/http/version-mismatch.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Pcap extracted from 2009-M57-day11-18.trace: The server replies with HTTP/1.1, then HTTP/1.0 (also different Server headers).
-# @TEST-EXEC: zeek -b -Cr $TRACES/http/version-mismatch.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/http/version-mismatch.pcap %INPUT
 # @TEST-EXEC: btest-diff http.log
 # @TEST-EXEC: btest-diff weird.log
 
diff --git a/testing/btest/scripts/base/protocols/ldap/add.zeek b/testing/btest/scripts/base/protocols/ldap/add.zeek
index f1b05c6ed5..90f78d3ea4 100644
--- a/testing/btest/scripts/base/protocols/ldap/add.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/add.zeek
@@ -1,7 +1,7 @@
 # Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
 
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/ldap-add.pcap %INPUT
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/ldap-add.pcap %INPUT
 # @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff ldap.log
diff --git a/testing/btest/scripts/base/protocols/ldap/aduser1.zeek b/testing/btest/scripts/base/protocols/ldap/aduser1.zeek
index fdafa692f6..3ce356044d 100644
--- a/testing/btest/scripts/base/protocols/ldap/aduser1.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/aduser1.zeek
@@ -1,7 +1,7 @@
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/aduser1.pcap %INPUT
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/aduser1.pcap %INPUT
 # @TEST-EXEC: mkdir krb && mv *.log krb
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/aduser1-ntlm.pcap %INPUT
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/aduser1-ntlm.pcap %INPUT
 # @TEST-EXEC: mkdir ntlm && mv *.log ntlm
 # @TEST-EXEC: btest-diff krb/ldap.log
 # @TEST-EXEC: btest-diff krb/ldap_search.log
diff --git a/testing/btest/scripts/base/protocols/ldap/sasl-ntlm.zeek b/testing/btest/scripts/base/protocols/ldap/sasl-ntlm.zeek
index b80c8738ae..770f24fcef 100644
--- a/testing/btest/scripts/base/protocols/ldap/sasl-ntlm.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/sasl-ntlm.zeek
@@ -1,7 +1,7 @@
 # Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
 
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/sasl-ntlm.pcap %INPUT
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/sasl-ntlm.pcap %INPUT
 # @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff ldap.log
diff --git a/testing/btest/scripts/base/protocols/ldap/sasl-scram-sha-512.zeek b/testing/btest/scripts/base/protocols/ldap/sasl-scram-sha-512.zeek
index 3df3d12317..87950eda5c 100644
--- a/testing/btest/scripts/base/protocols/ldap/sasl-scram-sha-512.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/sasl-scram-sha-512.zeek
@@ -1,7 +1,7 @@
 # Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
 
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/sasl-scram-sha-512.pcap %INPUT
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/sasl-scram-sha-512.pcap %INPUT
 # @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff ldap.log
diff --git a/testing/btest/scripts/base/protocols/ldap/sasl-srp-who-am-i.zeek b/testing/btest/scripts/base/protocols/ldap/sasl-srp-who-am-i.zeek
index 687f8f99dd..5eae17b349 100644
--- a/testing/btest/scripts/base/protocols/ldap/sasl-srp-who-am-i.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/sasl-srp-who-am-i.zeek
@@ -1,7 +1,7 @@
 # Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
 
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/sasl-srp-who-am-i.pcap %INPUT
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/sasl-srp-who-am-i.pcap %INPUT
 # @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff ldap.log
diff --git a/testing/btest/scripts/base/protocols/ldap/spnego-ntlmssp.zeek b/testing/btest/scripts/base/protocols/ldap/spnego-ntlmssp.zeek
index 0fc75b0c2c..55d53119fb 100644
--- a/testing/btest/scripts/base/protocols/ldap/spnego-ntlmssp.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/spnego-ntlmssp.zeek
@@ -5,7 +5,7 @@
 # at https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
 
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/ctu-sme-11-win7ad-1-ldap-tcp-50041.pcap
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/ctu-sme-11-win7ad-1-ldap-tcp-50041.pcap
 # @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff ldap.log
diff --git a/testing/btest/scripts/base/protocols/ldap/starttls.zeek b/testing/btest/scripts/base/protocols/ldap/starttls.zeek
index 5ef4c425a9..9f864219be 100644
--- a/testing/btest/scripts/base/protocols/ldap/starttls.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/starttls.zeek
@@ -1,7 +1,7 @@
 # Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
 
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/ldap-starttls.pcap %INPUT >out
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/ldap-starttls.pcap %INPUT >out
 # @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/scripts/base/protocols/ldap/who-am-i.zeek b/testing/btest/scripts/base/protocols/ldap/who-am-i.zeek
index 4fba909496..84e8b17340 100644
--- a/testing/btest/scripts/base/protocols/ldap/who-am-i.zeek
+++ b/testing/btest/scripts/base/protocols/ldap/who-am-i.zeek
@@ -1,7 +1,7 @@
 # Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
 
 # @TEST-REQUIRES: have-spicy
-# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/ldap-who-am-i.pcap %INPUT >out
+# @TEST-EXEC: zeek -r ${TRACES}/ldap/ldap-who-am-i.pcap %INPUT >out
 # @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/scripts/base/protocols/pop3/basic.zeek b/testing/btest/scripts/base/protocols/pop3/basic.zeek
index d9094622d8..bc19ad0a35 100644
--- a/testing/btest/scripts/base/protocols/pop3/basic.zeek
+++ b/testing/btest/scripts/base/protocols/pop3/basic.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Ensure basic POP3 functionality.
-# @TEST-EXEC: zeek -C -b -r $TRACES/pop3/pop3.pcap %INPUT >out
+# @TEST-EXEC: zeek -b -r $TRACES/pop3/pop3.pcap %INPUT >out
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC: test ! -f weird.log
diff --git a/testing/btest/scripts/base/protocols/pop3/redis.zeek b/testing/btest/scripts/base/protocols/pop3/redis.zeek
index f4aa29c9b2..767fa81e40 100644
--- a/testing/btest/scripts/base/protocols/pop3/redis.zeek
+++ b/testing/btest/scripts/base/protocols/pop3/redis.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: The POP3 signature triggered on Redis traffic. Ensure the analyzer is eventually removed to avoid.
-# @TEST-EXEC: zeek -C -b -r $TRACES/pop3/redis-50-pings.pcap %INPUT >out
+# @TEST-EXEC: zeek -b -r $TRACES/pop3/redis-50-pings.pcap %INPUT >out
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC: btest-diff weird.log
diff --git a/testing/btest/scripts/base/protocols/postgresql/dump-events.zeek b/testing/btest/scripts/base/protocols/postgresql/dump-events.zeek
index 07f07a951b..b6f70c7328 100644
--- a/testing/btest/scripts/base/protocols/postgresql/dump-events.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/dump-events.zeek
@@ -1,8 +1,8 @@
 # @TEST-DOC: Test that misc/dump events works.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-select-now.pcap %INPUT >>output
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-insert-fail-drop-fail.pcap %INPUT >>output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-select-now.pcap %INPUT >>output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-insert-fail-drop-fail.pcap %INPUT >>output
 #
 # @TEST-EXEC: btest-diff output
 
diff --git a/testing/btest/scripts/base/protocols/postgresql/http-on-port-5432.zeek b/testing/btest/scripts/base/protocols/postgresql/http-on-port-5432.zeek
index c0173eee98..46c7c464ef 100644
--- a/testing/btest/scripts/base/protocols/postgresql/http-on-port-5432.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/http-on-port-5432.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test rejecting wrong protocol.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/http-on-port-5432.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/http-on-port-5432.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p history service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < analyzer_debug.log > analyzer.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/mysql-on-port-5432.zeek b/testing/btest/scripts/base/protocols/postgresql/mysql-on-port-5432.zeek
index 815d78c8f0..737235a9f8 100644
--- a/testing/btest/scripts/base/protocols/postgresql/mysql-on-port-5432.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/mysql-on-port-5432.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test rejecting wrong protocol.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/mysql-on-port-5432.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/mysql-on-port-5432.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p history service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < analyzer_debug.log > analyzer.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/parameter-status.zeek b/testing/btest/scripts/base/protocols/postgresql/parameter-status.zeek
index fffb9c63b8..bb2de94ad7 100644
--- a/testing/btest/scripts/base/protocols/postgresql/parameter-status.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/parameter-status.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test the parameter status event.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-login-no-sslrequest.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-login-no-sslrequest.pcap %INPUT >output
 #
 # @TEST-EXEC: btest-diff output
 
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-auth.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-auth.zeek
index d40d9bcc82..0cd16f09ed 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-auth.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-auth.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test Zeek parsing a trace file through the PostgreSQL analyzer.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-select-now.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-select-now.pcap %INPUT >output
 #
 # @TEST-EXEC: btest-diff output
 
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable-15432.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable-15432.zeek
index ca28dd3654..9cc3573cde 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable-15432.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable-15432.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that the dpd.sig picks up a plaintext connection on a non-standard port.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-aws-ssl-disable-15432.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-aws-ssl-disable-15432.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable.zeek
index c057c521b9..46bd2750b2 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-disable.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that SSLRequest is recognized and ssl.log exists
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-aws-ssl-disable.pcap %INPUT
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-aws-ssl-disable.pcap %INPUT
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require-15432.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require-15432.zeek
index 9bba902072..4be9a0df8c 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require-15432.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require-15432.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that the dpd.sig picks up the SSLRequest and server response on a non-standard port.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-aws-ssl-require-15432.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-aws-ssl-require-15432.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name < ssl.log > ssl.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require.zeek
index ec2e4bda50..368cee2bba 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-aws-ssl-require.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that SSLRequest is recognized and ssl.log exists
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-aws-ssl-require.pcap %INPUT
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-aws-ssl-require.pcap %INPUT
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name < ssl.log > ssl.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-create-insert-select.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-create-insert-select.zeek
index 13bf673800..a008b374a7 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-create-insert-select.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-create-insert-select.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Trace with CREATE TABLE, INSERT, SELECT DELETE and DROP.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-create-insert-select-delete-drop.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-create-insert-select-delete-drop.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-insert-fail-drop-fail.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-insert-fail-drop-fail.zeek
index b037213bc5..05d0a82438 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-insert-fail-drop-fail.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-insert-fail-drop-fail.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test Zeek parsing a trace file through the PostgreSQL analyzer.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-insert-fail-drop-fail.pcap ${PACKAGE} %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-insert-fail-drop-fail.pcap ${PACKAGE} %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-login-fail.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-login-fail.zeek
index 1ad7bf05a9..b5ff3728a8 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-login-fail.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-login-fail.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test Zeek parsing a trace file through the PostgreSQL analyzer.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-login-fail.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-login-fail.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-login-no-sslrequest.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-login-no-sslrequest.zeek
index 7814304611..0539da707a 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-login-no-sslrequest.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-login-no-sslrequest.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: The client does not start with SSLRequest. This pcap has two connections, attempting without password.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-login-no-sslrequest.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-login-no-sslrequest.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/psql-select-now.zeek b/testing/btest/scripts/base/protocols/postgresql/psql-select-now.zeek
index ce631c9825..2b89e4f9ba 100644
--- a/testing/btest/scripts/base/protocols/postgresql/psql-select-now.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/psql-select-now.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test Zeek parsing a trace file through the PostgreSQL analyzer.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-select-now.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-select-now.pcap %INPUT >output
 # @TEST-EXEC: zeek-cut -m ts uid id.orig_h id.orig_p id.resp_h id.resp_p service  < conn.log > conn.cut
 # @TEST-EXEC: zeek-cut -m < postgresql.log > postgresql.cut
 #
diff --git a/testing/btest/scripts/base/protocols/postgresql/startup-parameter.zeek b/testing/btest/scripts/base/protocols/postgresql/startup-parameter.zeek
index 77b23b45b7..b0cd4c35ea 100644
--- a/testing/btest/scripts/base/protocols/postgresql/startup-parameter.zeek
+++ b/testing/btest/scripts/base/protocols/postgresql/startup-parameter.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Event for name, value pairs in the startup message.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -b -Cr ${TRACES}/postgresql/psql-login-no-sslrequest.pcap %INPUT >output
+# @TEST-EXEC: zeek -b -r ${TRACES}/postgresql/psql-login-no-sslrequest.pcap %INPUT >output
 #
 # @TEST-EXEC: btest-diff output
 
diff --git a/testing/btest/scripts/base/protocols/quic/analyzer-confirmations.zeek b/testing/btest/scripts/base/protocols/quic/analyzer-confirmations.zeek
index 790bea7ff2..230a618c68 100644
--- a/testing/btest/scripts/base/protocols/quic/analyzer-confirmations.zeek
+++ b/testing/btest/scripts/base/protocols/quic/analyzer-confirmations.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test the order of analyzer confirmations for QUIC and SSL, QUIC should come first.
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/chromium-115.0.5790.110-api-cirrus-com.pcap %INPUT >out
+# @TEST-EXEC: zeek -r $TRACES/quic/chromium-115.0.5790.110-api-cirrus-com.pcap %INPUT >out
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff out
 # @TEST-EXEC: btest-diff conn.log.cut
diff --git a/testing/btest/scripts/base/protocols/quic/chromium.zeek b/testing/btest/scripts/base/protocols/quic/chromium.zeek
index b53055f53f..1a671d24e0 100644
--- a/testing/btest/scripts/base/protocols/quic/chromium.zeek
+++ b/testing/btest/scripts/base/protocols/quic/chromium.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that runs the pcap
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/chromium-115.0.5790.110-api-cirrus-com.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/chromium-115.0.5790.110-api-cirrus-com.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/decrypt-fail-google-de-51833.zeek b/testing/btest/scripts/base/protocols/quic/decrypt-fail-google-de-51833.zeek
index 23c9cdaf0e..9727432b65 100644
--- a/testing/btest/scripts/base/protocols/quic/decrypt-fail-google-de-51833.zeek
+++ b/testing/btest/scripts/base/protocols/quic/decrypt-fail-google-de-51833.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: PCAP for which decryption failed due to not using the initial destination connection ID consistently.
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/quic-decrypt-fail-google-de-51833.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/quic-decrypt-fail-google-de-51833.pcap base/protocols/quic
 # @TEST-EXEC: test ! -f analyzer.log
 # @TEST-EXEC: test ! -f dpd.log
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
diff --git a/testing/btest/scripts/base/protocols/quic/events.zeek b/testing/btest/scripts/base/protocols/quic/events.zeek
index b95c735840..fa515007ff 100644
--- a/testing/btest/scripts/base/protocols/quic/events.zeek
+++ b/testing/btest/scripts/base/protocols/quic/events.zeek
@@ -1,9 +1,9 @@
 # @TEST-DOC: Supported events so far.
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/interop/quic-go_quic-go/retry.pcap base/protocols/quic %INPUT >out
+# @TEST-EXEC: zeek -r $TRACES/quic/interop/quic-go_quic-go/retry.pcap base/protocols/quic %INPUT >out
 # @TEST-EXEC: echo "zerortt.pcap" >>out
-# @TEST-EXEC: zeek -Cr $TRACES/quic/interop/quic-go_quic-go/zerortt.pcap base/protocols/quic %INPUT >>out
+# @TEST-EXEC: zeek -r $TRACES/quic/interop/quic-go_quic-go/zerortt.pcap base/protocols/quic %INPUT >>out
 # @TEST-EXEC: btest-diff out
 # @TEST-EXEC: btest-diff .stderr
 #
diff --git a/testing/btest/scripts/base/protocols/quic/firefox.zeek b/testing/btest/scripts/base/protocols/quic/firefox.zeek
index 31d2358743..5e2b2c222b 100644
--- a/testing/btest/scripts/base/protocols/quic/firefox.zeek
+++ b/testing/btest/scripts/base/protocols/quic/firefox.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that runs the pcap
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/firefox-102.13.0esr-blog-cloudflare-com.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/firefox-102.13.0esr-blog-cloudflare-com.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/handshake.zeek b/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/handshake.zeek
index 0def3cf306..6ee3367726 100644
--- a/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/handshake.zeek
+++ b/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/handshake.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test interop pcap containing RETRY packet from server side.
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/interop/quic-go_quic-go/handshake.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/interop/quic-go_quic-go/handshake.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/retry.zeek b/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/retry.zeek
index 2fa6e34017..31bc409918 100644
--- a/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/retry.zeek
+++ b/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/retry.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test interop pcap containing RETRY packet from server side.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/interop/quic-go_quic-go/retry.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/interop/quic-go_quic-go/retry.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/zerortt.zeek b/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/zerortt.zeek
index e1d5c698a2..893d35a5ff 100644
--- a/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/zerortt.zeek
+++ b/testing/btest/scripts/base/protocols/quic/interop/quic-go_quic-go/zerortt.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that client initiating connection using 0RTT packet doesn't cause analyzer errors trying to decrypt server side.
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/interop/quic-go_quic-go/zerortt.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/interop/quic-go_quic-go/zerortt.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/max-history-length.zeek b/testing/btest/scripts/base/protocols/quic/max-history-length.zeek
index 25dd2989ea..b74bcd1278 100644
--- a/testing/btest/scripts/base/protocols/quic/max-history-length.zeek
+++ b/testing/btest/scripts/base/protocols/quic/max-history-length.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that runs the pcap
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/firefox-102.13.0esr-blog-cloudflare-com.pcap base/protocols/quic QUIC::max_history_length=3
+# @TEST-EXEC: zeek -r $TRACES/quic/firefox-102.13.0esr-blog-cloudflare-com.pcap base/protocols/quic QUIC::max_history_length=3
 # @TEST-EXEC: zeek-cut -m ts uid history < quic.log > quic.log.cut
 # @TEST-EXEC: btest-diff quic.log.cut
 # @TEST-EXEC: btest-diff weird.log
diff --git a/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto-only-initial.zeek b/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto-only-initial.zeek
index 0537353ecb..0b58222e7a 100644
--- a/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto-only-initial.zeek
+++ b/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto-only-initial.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Pcap with CRYPTO frames fragemented over multiple INITIAL packets. The pcap only contains 3 INITIAL packets. Check what logs are created.
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/quic-multiple-initial-fragmented-crypto-only-initial.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/quic-multiple-initial-fragmented-crypto-only-initial.pcap base/protocols/quic
 # @TEST-EXEC: test ! -f analyzer.log
 # @TEST-EXEC: test ! -f dpd.log
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
diff --git a/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto.zeek b/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto.zeek
index 98696053bd..6287eeac4c 100644
--- a/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto.zeek
+++ b/testing/btest/scripts/base/protocols/quic/multiple-initial-fragmented-crypto.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Pcap with CRYPTO frames fragemented over multiple INITIAL packets.
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/quic-multiple-initial-fragmented-crypto.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/quic-multiple-initial-fragmented-crypto.pcap base/protocols/quic
 # @TEST-EXEC: test ! -f analyzer.log
 # @TEST-EXEC: test ! -f dpd.log
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
diff --git a/testing/btest/scripts/base/protocols/quic/quicdoq.zeek b/testing/btest/scripts/base/protocols/quic/quicdoq.zeek
index a9bc28dd39..d05477a503 100644
--- a/testing/btest/scripts/base/protocols/quic/quicdoq.zeek
+++ b/testing/btest/scripts/base/protocols/quic/quicdoq.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Pcap with dns-over-quic lookup using https://github.com/private-octopus/quicdoq
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/quicdoq.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/quicdoq.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/quicv2-echo-443.zeek b/testing/btest/scripts/base/protocols/quic/quicv2-echo-443.zeek
index 51b80ccaa7..7bc17a5bde 100644
--- a/testing/btest/scripts/base/protocols/quic/quicv2-echo-443.zeek
+++ b/testing/btest/scripts/base/protocols/quic/quicv2-echo-443.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Pcap with quicv2 echo traffic produced with https://raw.githubusercontent.com/quic-go/quic-go/master/example/echo/echo.go
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/quicv2-echo-443.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/quicv2-echo-443.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/quicv2-http3-443.zeek b/testing/btest/scripts/base/protocols/quic/quicv2-http3-443.zeek
index 9b10252b40..6ac094f369 100644
--- a/testing/btest/scripts/base/protocols/quic/quicv2-http3-443.zeek
+++ b/testing/btest/scripts/base/protocols/quic/quicv2-http3-443.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Pcap with quicv2 http3 traffic produced with https://raw.githubusercontent.com/quic-go/quic-go/master/example/main.go
 #
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/quicv2-http3-443.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/quicv2-http3-443.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/run-pcap.zeek b/testing/btest/scripts/base/protocols/quic/run-pcap.zeek
index d280dd6043..23eab015df 100644
--- a/testing/btest/scripts/base/protocols/quic/run-pcap.zeek
+++ b/testing/btest/scripts/base/protocols/quic/run-pcap.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that runs the pcap
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/quic_win11_firefox_google.pcap base/protocols/quic
+# @TEST-EXEC: zeek -r $TRACES/quic/quic_win11_firefox_google.pcap base/protocols/quic
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
 # @TEST-EXEC: btest-diff ssl.log
diff --git a/testing/btest/scripts/base/protocols/quic/vector-max-size-crash.zeek b/testing/btest/scripts/base/protocols/quic/vector-max-size-crash.zeek
index d43c39b440..83bc956c05 100644
--- a/testing/btest/scripts/base/protocols/quic/vector-max-size-crash.zeek
+++ b/testing/btest/scripts/base/protocols/quic/vector-max-size-crash.zeek
@@ -1,7 +1,7 @@
 # @TEST-DOC: Test that runs the pcap
 
 # @TEST-REQUIRES: ${SCRIPTS}/have-spicy
-# @TEST-EXEC: zeek -Cr $TRACES/quic/vector-max-size-crash.pcap base/protocols/quic %INPUT > out
+# @TEST-EXEC: zeek -r $TRACES/quic/vector-max-size-crash.pcap base/protocols/quic %INPUT > out
 # @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
 # @TEST-EXEC: zeek-cut -m ts cause uid analyzer_kind analyzer_name failure_reason < analyzer_debug.log > analyzer_debug.log.cut
 # @TEST-EXEC: btest-diff conn.log.cut
diff --git a/testing/btest/scripts/base/protocols/rdp/rdp-invalid-length.zeek b/testing/btest/scripts/base/protocols/rdp/rdp-invalid-length.zeek
index 665ff5b00a..0a2b1ce1a4 100644
--- a/testing/btest/scripts/base/protocols/rdp/rdp-invalid-length.zeek
+++ b/testing/btest/scripts/base/protocols/rdp/rdp-invalid-length.zeek
@@ -2,7 +2,7 @@
 # header, ensuring that it throws a binpac exception and reports a notice to
 # analyzer.log. The pcap used is a snippet of a pcap from OSS-Fuzz #57109.
 
-# @TEST-EXEC: zeek -C -b -r $TRACES/rdp/rdp-invalid-length.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/rdp/rdp-invalid-length.pcap %INPUT
 # @TEST-EXEC: btest-diff analyzer_debug.log
 
 @load frameworks/analyzer/debug-logging.zeek
diff --git a/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test b/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test
index 330e95eace..958f7ceb69 100644
--- a/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test
+++ b/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -r $TRACES/smb/dssetup_DsRoleGetPrimaryDomainInformation_standalone_workstation.cap %INPUT
+# @TEST-EXEC: zeek -r $TRACES/smb/dssetup_DsRoleGetPrimaryDomainInformation_standalone_workstation.cap %INPUT
 # @TEST-EXEC: [ ! -f dce_rpc.log ]
 
 @load base/protocols/smb
diff --git a/testing/btest/scripts/base/protocols/smb/smb2-create-delete-on-close.zeek b/testing/btest/scripts/base/protocols/smb/smb2-create-delete-on-close.zeek
index 5dbb5d147a..629f19c9c0 100644
--- a/testing/btest/scripts/base/protocols/smb/smb2-create-delete-on-close.zeek
+++ b/testing/btest/scripts/base/protocols/smb/smb2-create-delete-on-close.zeek
@@ -1,7 +1,7 @@
 # Don't run for C++ scripts because there's no script to compile.
 # @TEST-REQUIRES: test "${ZEEK_USE_CPP}" != "1"
 
-# @TEST-EXEC: zeek -C -r $TRACES/smb/smb2.delete-on-close-perms-delete-existing.pcap policy/protocols/smb/log-cmds
+# @TEST-EXEC: zeek -r $TRACES/smb/smb2.delete-on-close-perms-delete-existing.pcap policy/protocols/smb/log-cmds
 # @TEST-EXEC: btest-diff smb_files.log
 # @TEST-EXEC: btest-diff smb_cmd.log
 
diff --git a/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test b/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test
index 88667fca18..e97391244a 100644
--- a/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test
+++ b/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test
@@ -1,6 +1,6 @@
 # This tests checks that non-dtls connections to which we attach don't trigger tons of errors.
 
-# @TEST-EXEC: zeek -C -r $TRACES/dns-txt-multiple.trace %INPUT
+# @TEST-EXEC: zeek -r $TRACES/dns-txt-multiple.trace %INPUT
 # @TEST-EXEC: btest-diff .stdout
 
 event zeek_init()
diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test b/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test
index 0edea74f3b..abc86ea861 100644
--- a/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test
+++ b/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test
@@ -1,6 +1,6 @@
 # This tests a normal OCSP request sent through HTTP GET
 
-# @TEST-EXEC: zeek -C -r $TRACES/tls/ocsp-http-get.pcap %INPUT
+# @TEST-EXEC: zeek -r $TRACES/tls/ocsp-http-get.pcap %INPUT
 # @TEST-EXEC: btest-diff ocsp.log
 # @TEST-EXEC: btest-diff .stdout
 
diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test b/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test
index 76d9be5ce3..7c11bafc63 100644
--- a/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test
+++ b/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test
@@ -1,6 +1,6 @@
 # This tests a OCSP request missing response
 
-# @TEST-EXEC: zeek -C -r $TRACES/tls/ocsp-request-only.pcap %INPUT
+# @TEST-EXEC: zeek -r $TRACES/tls/ocsp-request-only.pcap %INPUT
 # @TEST-EXEC: btest-diff .stdout
 
 event zeek_init()
diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test b/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test
index 9c9666ff06..cb3f2667ac 100644
--- a/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test
+++ b/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test
@@ -1,6 +1,6 @@
 # This tests OCSP response with revocation
 
-# @TEST-EXEC: zeek -C -r $TRACES/tls/ocsp-revoked.pcap %INPUT
+# @TEST-EXEC: zeek -r $TRACES/tls/ocsp-revoked.pcap %INPUT
 # @TEST-EXEC: btest-diff ocsp.log
 # @TEST-EXEC: btest-diff .stdout
 
diff --git a/testing/btest/scripts/base/protocols/xmpp/client-dpd.test b/testing/btest/scripts/base/protocols/xmpp/client-dpd.test
index b89732a23e..4e84996b04 100644
--- a/testing/btest/scripts/base/protocols/xmpp/client-dpd.test
+++ b/testing/btest/scripts/base/protocols/xmpp/client-dpd.test
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/tls/xmpp-starttls.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/tls/xmpp-starttls.pcap %INPUT
 # @TEST-EXEC: btest-diff ssl.log
 
 @load base/frameworks/signatures
diff --git a/testing/btest/scripts/base/protocols/xmpp/starttls.test b/testing/btest/scripts/base/protocols/xmpp/starttls.test
index 9c21747431..cd5a025731 100644
--- a/testing/btest/scripts/base/protocols/xmpp/starttls.test
+++ b/testing/btest/scripts/base/protocols/xmpp/starttls.test
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/tls/xmpp-starttls.pcap %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/tls/xmpp-starttls.pcap %INPUT
 # @TEST-EXEC: btest-diff conn.log
 # @TEST-EXEC: btest-diff ssl.log
 # @TEST-EXEC: btest-diff x509.log
diff --git a/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek b/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek
index d9dcdff2b2..3d847f50da 100644
--- a/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek
+++ b/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek
@@ -1,4 +1,4 @@
-# @TEST-EXEC: zeek -b -Cr $TRACES/wikipedia.trace %INPUT
+# @TEST-EXEC: zeek -b -r $TRACES/wikipedia.trace %INPUT
 # @TEST-EXEC: btest-diff intel.log
 
 #@TEST-START-FILE intel.dat
diff --git a/testing/btest/scripts/policy/frameworks/telemetry/log-prefixes.zeek b/testing/btest/scripts/policy/frameworks/telemetry/log-prefixes.zeek
index 0752c605e2..32c9fc8790 100644
--- a/testing/btest/scripts/policy/frameworks/telemetry/log-prefixes.zeek
+++ b/testing/btest/scripts/policy/frameworks/telemetry/log-prefixes.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Tests that setting log_prefixes filters out the zeek metrics normally created.
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -r - %INPUT > out
 
 # @TEST-EXEC: btest-diff telemetry.log
 # @TEST-EXEC: btest-diff telemetry_histogram.log
diff --git a/testing/btest/scripts/policy/frameworks/telemetry/log.zeek b/testing/btest/scripts/policy/frameworks/telemetry/log.zeek
index 1faff83719..c8d0fabe0b 100644
--- a/testing/btest/scripts/policy/frameworks/telemetry/log.zeek
+++ b/testing/btest/scripts/policy/frameworks/telemetry/log.zeek
@@ -1,5 +1,5 @@
 # @TEST-DOC: Test loading of telemetry/log and smoke check the telemetry.log file
-# @TEST-EXEC: zeek -b -Cr $TRACES/wikipedia.trace %INPUT > out
+# @TEST-EXEC: zeek -b -r $TRACES/wikipedia.trace %INPUT > out
 # @TEST-EXEC: grep -E 'zeek_(net|.*sessions)' telemetry.log > telemetry.log.filtered
 # @TEST-EXEC: grep 'zeek.*connection_duration' telemetry_histogram.log > telemetry_histogram.log.filtered
 
diff --git a/testing/btest/spicy/export-bitfield.zeek b/testing/btest/spicy/export-bitfield.zeek
index 6043122a82..6f89496e16 100644
--- a/testing/btest/spicy/export-bitfield.zeek
+++ b/testing/btest/spicy/export-bitfield.zeek
@@ -1,7 +1,7 @@
 # @TEST-REQUIRES: have-spicy
 #
 # @TEST-EXEC: spicyz -do export.hlto export.spicy export.evt
-# @TEST-EXEC: zeek -Cr $TRACES/http/post.trace export.hlto %INPUT >>output
+# @TEST-EXEC: zeek -r $TRACES/http/post.trace export.hlto %INPUT >>output
 # @TEST-EXEC: test '!' -e reporter.log
 # @TEST-EXEC: btest-diff output
 #
diff --git a/testing/btest/spicy/export-type-e2e.zeek b/testing/btest/spicy/export-type-e2e.zeek
index 310bddada2..b582906080 100644
--- a/testing/btest/spicy/export-type-e2e.zeek
+++ b/testing/btest/spicy/export-type-e2e.zeek
@@ -1,7 +1,7 @@
 # @TEST-REQUIRES: have-spicy
 #
 # @TEST-EXEC: spicyz -do export.hlto export.spicy export.evt
-# @TEST-EXEC: zeek -Cr $TRACES/http/pipelined-requests.trace export.hlto %INPUT >>output
+# @TEST-EXEC: zeek -r $TRACES/http/pipelined-requests.trace export.hlto %INPUT >>output
 # @TEST-EXEC: test '!' -e reporter.log
 # @TEST-EXEC: btest-diff output
 #
diff --git a/testing/btest/spicy/hook-priority.zeek b/testing/btest/spicy/hook-priority.zeek
index b7f8f3ca0b..ac8117ed5a 100644
--- a/testing/btest/spicy/hook-priority.zeek
+++ b/testing/btest/spicy/hook-priority.zeek
@@ -1,6 +1,6 @@
 # @TEST-REQUIRES: have-spicy
 # @TEST-EXEC: spicyz -d -o foo.hlto foo.spicy foo.evt
-# @TEST-EXEC: zeek -Cr ${TRACES}/http/post.trace Zeek::Spicy foo.hlto %INPUT >>output 2>&1
+# @TEST-EXEC: zeek -r ${TRACES}/http/post.trace Zeek::Spicy foo.hlto %INPUT >>output 2>&1
 # @TEST-EXEC: btest-diff output
 #
 # @TEST-DOC: This test validates that hooks from EVT files are invoked after hooks in the Spicy grammar.
diff --git a/testing/btest/spicy/packet-analyzer-violation.zeek b/testing/btest/spicy/packet-analyzer-violation.zeek
index 46c2ce4af7..6880975225 100644
--- a/testing/btest/spicy/packet-analyzer-violation.zeek
+++ b/testing/btest/spicy/packet-analyzer-violation.zeek
@@ -1,7 +1,7 @@
 # @TEST-REQUIRES: have-spicy
 #
 # @TEST-EXEC: spicyz -d -o zeek_test.hlto analyzer.spicy analyzer.evt
-# @TEST-EXEC: HILTI_DEBUG=spicy zeek -Cr ${TRACES}/spicy/packet-analyzer-violation.pcap zeek_test.hlto %INPUT >output 2>&1
+# @TEST-EXEC: HILTI_DEBUG=spicy zeek -r ${TRACES}/spicy/packet-analyzer-violation.pcap zeek_test.hlto %INPUT >output 2>&1
 # @TEST-EXEC: btest-diff output
 #
 # @TEST-DOC: Checks that packet analyzers correctly report violations. This is a regression test for #132.
diff --git a/testing/btest/spicy/port-range-one-port.zeek b/testing/btest/spicy/port-range-one-port.zeek
index bdc5219791..36c6bcc5f7 100644
--- a/testing/btest/spicy/port-range-one-port.zeek
+++ b/testing/btest/spicy/port-range-one-port.zeek
@@ -1,7 +1,7 @@
 # @TEST-REQUIRES: have-spicy
 #
 # @TEST-EXEC: spicyz -o test.hlto udp-test.spicy ./udp-test.evt
-# @TEST-EXEC: HILTI_DEBUG=zeek zeek -Cr ${TRACES}/udp-packet.pcap test.hlto %INPUT >out 2>&1
+# @TEST-EXEC: HILTI_DEBUG=zeek zeek -r ${TRACES}/udp-packet.pcap test.hlto %INPUT >out 2>&1
 # @TEST-EXEC: grep -e 'Scheduling analyzer' -e 'error during parsing' < out > out.filtered
 # @TEST-EXEC: btest-diff out.filtered
 
diff --git a/testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek b/testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek
index 516522557f..4d2d4cca7e 100644
--- a/testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek
+++ b/testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek
@@ -1,7 +1,7 @@
 # @TEST-REQUIRES: have-spicy
 #
 # @TEST-EXEC: spicyz -d foo.spicy foo.evt -o foo.hlto
-# @TEST-EXEC: zeek -Cr ${TRACES}/http/206_example_b.pcap foo.hlto "Spicy::enable_print=T" >output 2>&1
+# @TEST-EXEC: zeek -r ${TRACES}/http/206_example_b.pcap foo.hlto "Spicy::enable_print=T" >output 2>&1
 # @TEST-EXEC: btest-diff output
 #
 # @TEST-DOC: Exercise &eod behavior when processing is aborted without a regular connection shutdown; regression test for Zeek #4501.