diff --git a/docs/changes.txt b/docs/changes.txt
index c216d2a..d63531e 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -80,3 +80,7 @@ v0.6.1
 * zapret-lib, zapret-auto: condition and stopif orchestrators
 * zapret-lib: detect_payload_str - sample lua payload detector
 * blockcheck2: unterminated string fix
+
+v0.6.2
+
+* nfqws2, zapret-lib : fix non-working % and # arg substitution under orchestrator
diff --git a/lua/zapret-lib.lua b/lua/zapret-lib.lua
index d4c5898..072ee12 100644
--- a/lua/zapret-lib.lua
+++ b/lua/zapret-lib.lua
@@ -126,17 +126,17 @@ end
 
 
 -- applies # and $ prefixes. #var means var length, %var means var value
-function apply_arg_prefix(arg)
-	for a,v in pairs(arg) do
+function apply_arg_prefix(desync)
+	for a,v in pairs(desync.arg) do
 		local c = string.sub(v,1,1)
-		if v=='#' then
-			arg[a] = #_G[string.sub(v,2)]
-		elseif v=='%' then
-			arg[a] = _G[string.sub(v,2)]
-		elseif v=='\\' then
+		if c=='#' then
+			desync.arg[a] = #blob(desync,string.sub(v,2))
+		elseif c=='%' then
+			desync.arg[a] = blob(desync,string.sub(v,2))
+		elseif c=='\\' then
 			c = string.sub(v,2,2);
 			if c=='#' or c=='%' then
-				arg[a] = string.sub(v,2)
+				desync.arg[a] = string.sub(v,2)
 			end
 		end
 	end
@@ -147,7 +147,7 @@ function apply_execution_plan(desync, instance)
 	desync.func_n = instance.func_n
 	desync.func_instance = instance.func_instance
 	desync.arg = deepcopy(instance.arg)
-	apply_arg_prefix(desync.arg)
+	apply_arg_prefix(desync)
 end
 -- produce resulting verdict from 2 verdicts
 function verdict_aggregate(v1, v2)
diff --git a/nfq2/desync.c b/nfq2/desync.c
index dc303d3..610bcc5 100644
--- a/nfq2/desync.c
+++ b/nfq2/desync.c
@@ -808,7 +808,7 @@ static uint8_t desync(
 							}
 							lua_pushlightuserdata(params.L, &ctx);
 							lua_rawgeti(params.L, LUA_REGISTRYINDEX, ref_arg);
-							lua_pushf_args(&func->args, -1);
+							lua_pushf_args(&func->args, -1, true);
 							lua_pushf_str("func", func->func);
 							lua_pushf_int("func_n", ctx.func_n);
 							lua_pushf_str("func_instance", instance);
diff --git a/nfq2/lua.c b/nfq2/lua.c
index a954ee8..3fab0a9 100644
--- a/nfq2/lua.c
+++ b/nfq2/lua.c
@@ -841,7 +841,7 @@ static int luacall_execution_plan(lua_State *L)
 			range = ctx->incoming ? &func->range_in : &func->range_out;
 			lua_pushinteger(params.L, n - ctx->func_n);
 			lua_createtable(params.L, 0, 6);
-			lua_pushf_args(&func->args, -1);
+			lua_pushf_args(&func->args, -1, false);
 			lua_pushf_str("func", func->func);
 			lua_pushf_int("func_n", ctx->func_n);
 			lua_pushf_str("func_instance", instance);
@@ -1320,7 +1320,7 @@ void lua_pushf_ctrack(const t_ctrack *ctrack, const t_ctrack_position *pos)
 	LUA_STACK_GUARD_LEAVE(params.L, 0)
 }
 
-void lua_pushf_args(const struct str2_list_head *args, int idx_desync)
+void lua_pushf_args(const struct str2_list_head *args, int idx_desync, bool subst_prefix)
 {
 	// var=val - pass val string
 	// var=%val - subst 'val' blob
@@ -1341,17 +1341,22 @@ void lua_pushf_args(const struct str2_list_head *args, int idx_desync)
 	{
 		var = arg->str1;
 		val = arg->str2 ? arg->str2 : "";
-		if (val[0]=='\\' && (val[1]=='%' || val[1]=='#'))
-			// escape char
-			lua_pushf_str(var, val+1);
-		else if (val[0]=='%')
-			lua_pushf_blob(idx_desync, var, val+1);
-		else if (val[0]=='#')
+		if (subst_prefix)
 		{
-			lua_push_blob(idx_desync, val+1);
-			lua_Integer len = lua_rawlen(params.L, -1);
-			lua_pop(params.L,1);
-			lua_pushf_int(var, len);
+			if (val[0]=='\\' && (val[1]=='%' || val[1]=='#'))
+				// escape char
+				lua_pushf_str(var, val+1);
+			else if (val[0]=='%')
+				lua_pushf_blob(idx_desync, var, val+1);
+			else if (val[0]=='#')
+			{
+				lua_push_blob(idx_desync, val+1);
+				lua_Integer len = lua_rawlen(params.L, -1);
+				lua_pop(params.L,1);
+				lua_pushf_int(var, len);
+			}
+			else
+				lua_pushf_str(var, val);
 		}
 		else
 			lua_pushf_str(var, val);