diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index 87d6aefc84..44f9ee57bd 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -1465,6 +1465,10 @@ int bus_set_transient_exec_command(
                 if (r < 0)
                         return r;
 
+                if (strv_isempty(argv))
+                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
+                                                 "\"%s\" argv cannot be empty", name);
+
                 r = is_ex_prop ? sd_bus_message_read_strv(message, &ex_opts) : sd_bus_message_read(message, "b", &b);
                 if (r < 0)
                         return r;
diff --git a/src/core/service.c b/src/core/service.c
index f331c45de0..16d9456719 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -564,6 +564,22 @@ static int service_verify(Service *s) {
         assert(s);
         assert(UNIT(s)->load_state == UNIT_LOADED);
 
+        for (ServiceExecCommand c = 0; c < _SERVICE_EXEC_COMMAND_MAX; c++) {
+                ExecCommand *command;
+
+                LIST_FOREACH(command, command, s->exec_command[c]) {
+                        if (!path_is_absolute(command->path) && !filename_is_valid(command->path))
+                                return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC),
+                                                            "Service %s= binary path \"%s\" is neither a valid executable name nor an absolute path. Refusing.",
+                                                            command->path,
+                                                            service_exec_command_to_string(c));
+                        if (strv_isempty(command->argv))
+                                return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC),
+                                                            "Service has an empty argv in %s=. Refusing.",
+                                                            service_exec_command_to_string(c));
+                }
+        }
+
         if (!s->exec_command[SERVICE_EXEC_START] && !s->exec_command[SERVICE_EXEC_STOP] &&
             UNIT(s)->success_action == EMERGENCY_ACTION_NONE)
                 /* FailureAction= only makes sense if one of the start or stop commands is specified.
diff --git a/test/units/testsuite-23.sh b/test/units/testsuite-23.sh
index 4ef7c878a8..5488447a87 100755
--- a/test/units/testsuite-23.sh
+++ b/test/units/testsuite-23.sh
@@ -27,6 +27,37 @@ test "$(systemctl show --value -p RestartKillSignal seven.service)" -eq 2
 systemctl restart seven.service
 systemctl stop seven.service
 
+# For issue #20933
+
+# Should work normally
+busctl call \
+  org.freedesktop.systemd1 /org/freedesktop/systemd1 \
+  org.freedesktop.systemd1.Manager StartTransientUnit \
+  "ssa(sv)a(sa(sv))" test-20933-ok.service replace 1 \
+    ExecStart "a(sasb)" 1 \
+      /usr/bin/sleep 2 /usr/bin/sleep 1 true \
+  0
+
+# DBus call should fail but not crash systemd
+busctl call \
+  org.freedesktop.systemd1 /org/freedesktop/systemd1 \
+  org.freedesktop.systemd1.Manager StartTransientUnit \
+  "ssa(sv)a(sa(sv))" test-20933-bad.service replace 1 \
+    ExecStart "a(sasb)" 1 \
+      /usr/bin/sleep 0 true \
+  0 && { echo 'unexpected success'; exit 1; }
+
+# Same but with the empty argv in the middle
+busctl call \
+  org.freedesktop.systemd1 /org/freedesktop/systemd1 \
+  org.freedesktop.systemd1.Manager StartTransientUnit \
+  "ssa(sv)a(sa(sv))" test-20933-bad-middle.service replace 1 \
+    ExecStart "a(sasb)" 3 \
+      /usr/bin/sleep 2 /usr/bin/sleep 1 true \
+      /usr/bin/sleep 0                  true \
+      /usr/bin/sleep 2 /usr/bin/sleep 1 true \
+  0 && { echo 'unexpected success'; exit 1; }
+
 systemd-analyze log-level info
 
 echo OK >/testok