diff --git a/ChangeLog b/ChangeLog
index 23e7ef6d3..4356a564e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2023-09-16  Bart Schaefer  <schaefer@zsh.org>
 
+	* 52156: Test/E01options.ztst: Test case for user/29160.
+
+	* users/29160: Src/subst.c: Fix repetition of substituion modifier.
+
 	* Christoffer Lundell: 52082: Functions/Zle/edit-command-line:
 	Enable linewise edit-command when in visual-line mode.
 
diff --git a/Src/subst.c b/Src/subst.c
index 52afd6484..dc2052ee0 100644
--- a/Src/subst.c
+++ b/Src/subst.c
@@ -4689,7 +4689,8 @@ modify(char **str, char **ptr, int inbrace)
 		    case 'S':
 			hsubpatopt = (c == 'S');
 			if (hsubl && hsubr)
-			    subst(&copy, hsubl, hsubr, gbal, hsubpatopt);
+			    subst(&copy, dupstring(hsubl), dupstring(hsubr),
+				  gbal, hsubpatopt);
 			break;
 		    case 'q':
 			copy = quotestring(copy, QT_BACKSLASH_SHOWNULL);
@@ -4777,7 +4778,8 @@ modify(char **str, char **ptr, int inbrace)
 		case 'S':
 		    hsubpatopt = (c == 'S');
 		    if (hsubl && hsubr)
-			subst(str, hsubl, hsubr, gbal, hsubpatopt);
+			subst(str, dupstring(hsubl), dupstring(hsubr),
+			      gbal, hsubpatopt);
 		    break;
 		case 'q':
 		    *str = quotestring(*str, QT_BACKSLASH);
diff --git a/Test/E01options.ztst b/Test/E01options.ztst
index 83f0371a1..363846f5c 100644
--- a/Test/E01options.ztst
+++ b/Test/E01options.ztst
@@ -561,12 +561,14 @@
   foo=(one.c two.c three.c)
   print ${foo:s/#%(#b)t(*).c/T${match[1]}.X/}
   print *(#q:s/#(#b)tmp(*e)/'scrunchy${match[1]}'/)
+  print ${${:-"left[({})]over"}:fs/(\\{\\}|\\(\\)|\\[\\])//}
   unsetopt histsubstpattern
 0:HIST_SUBST_PATTERN option
 >TINGcd TINGfile1 TINGfile2 homedir
 >THUMPcd THUMPfile1 THUMPfile2
 >one.c Two.X Three.X
 >homedir scrunchyfile1 scrunchyfile2 tmpcd
+>leftover
 
   setopt ignorebraces
   echo X{a,b}Y