diff --git a/plugins/commando.c b/plugins/commando.c
index c3e3aca2b..fd9c86a0d 100644
--- a/plugins/commando.c
+++ b/plugins/commando.c
@@ -263,7 +263,8 @@ static void handle_incmd(struct node_id *peer,
 {
 	struct commando *incmd;
 
-	/* FIXME: don't do *anything* unless they've set up a rune. */
+	if (!rune_counter)
+		return;
 
 	incmd = find_commando(incoming_commands, peer, NULL);
 	/* Don't let them buffer multiple commands: discard old. */
diff --git a/tests/test_plugin.py b/tests/test_plugin.py
index b706baaaf..471d3bc5a 100644
--- a/tests/test_plugin.py
+++ b/tests/test_plugin.py
@@ -13,6 +13,7 @@ from utils import (
 )
 
 import ast
+import concurrent.futures
 import json
 import os
 import pytest
@@ -2549,6 +2550,15 @@ def test_plugin_shutdown(node_factory):
 def test_commando(node_factory, executor):
     l1, l2 = node_factory.line_graph(2, fundchannel=False)
 
+    # Nothing works until we've issued a rune.
+    fut = executor.submit(l2.rpc.call, method='commando',
+                          payload={'peer_id': l1.info['id'],
+                                   'method': 'listpeers'})
+    with pytest.raises(concurrent.futures.TimeoutError):
+        fut.result(10)
+
+    l1.rpc.commando_rune()
+
     # This works
     res = l2.rpc.call(method='commando',
                       payload={'peer_id': l1.info['id'],