diff --git a/crates/bashkit/src/interpreter/mod.rs b/crates/bashkit/src/interpreter/mod.rs
index 1a0004ca5..ffabc4f80 100644
--- a/crates/bashkit/src/interpreter/mod.rs
+++ b/crates/bashkit/src/interpreter/mod.rs
@@ -5804,11 +5804,21 @@ impl Interpreter {
                     && self.subst_generation == pre_assign_subst_gen
                 {
                     0
+                } else if command.assignments.is_empty() && !command.redirects.is_empty() {
+                    // Redirect-only null command (`> file`, `< file`).
+                    0
                 } else {
                     self.last_exit_code
                 };
-                self.last_exit_code = exit_code;
                 self.discard_deferred_proc_subs_from(deferred_proc_sub_start);
+                if !command.redirects.is_empty() {
+                    // Null commands still perform their redirections: `> f`
+                    // truncates, `< missing` fails with status 1.
+                    return self
+                        .execute_null_command_redirects(exit_code, &command.redirects)
+                        .await;
+                }
+                self.last_exit_code = exit_code;
                 return Ok(ExecResult {
                     stdout: crate::StreamData::new(),
                     stderr: crate::StreamData::new(),
@@ -8827,6 +8837,55 @@ impl Interpreter {
         self.last_bg_pid = snap.last_bg_pid;
     }
 
+    /// Perform the redirections of a null command (no command word) and
+    /// return its result. Input redirects are opened and discarded.
+    async fn execute_null_command_redirects(
+        &mut self,
+        exit_code: i32,
+        redirects: &[Redirect],
+    ) -> Result<ExecResult> {
+        if let Some(stderr) = self.logic_only_redirect_error(redirects) {
+            self.last_exit_code = 1;
+            return Ok(ExecResult::err(stderr, 1));
+        }
+        match self.process_input_redirections(None, redirects).await {
+            Ok(_) => {}
+            Err(crate::error::Error::CommandFailure(msg)) => {
+                self.last_exit_code = 1;
+                return Ok(ExecResult::err(msg, 1));
+            }
+            Err(e) => return Err(e),
+        }
+        let result = ExecResult {
+            exit_code,
+            ..Default::default()
+        };
+        let result = self.apply_redirections(result, redirects).await?;
+        self.last_exit_code = result.exit_code;
+        Ok(result)
+    }
+
+    /// Match `$(<file)`: a lone simple command with no name, arguments or
+    /// assignments and a single stdin (`<`) redirect. Returns its redirects.
+    fn cmd_subst_file_read(commands: &[Command]) -> Option<&[Redirect]> {
+        let [Command::Simple(cmd)] = commands else {
+            return None;
+        };
+        let bare_name = cmd.name.parts.is_empty()
+            || matches!(cmd.name.parts.as_slice(), [WordPart::Literal(s)] if s.is_empty());
+        let [redirect] = cmd.redirects.as_slice() else {
+            return None;
+        };
+        (bare_name
+            && !cmd.name.quoted
+            && cmd.args.is_empty()
+            && cmd.assignments.is_empty()
+            && redirect.kind == RedirectKind::Input
+            && redirect.fd_var.is_none()
+            && matches!(redirect.fd, None | Some(0)))
+        .then_some(cmd.redirects.as_slice())
+    }
+
     fn execute_cmd_subst<'a>(
         &'a mut self,
         commands: &'a [Command],
@@ -8836,6 +8895,30 @@ impl Interpreter {
             // mutable state so mutations don't leak to the parent.
             let snapshot = self.snapshot_subshell_state();
             let mut stdout = String::new();
+            let file_read = Self::cmd_subst_file_read(commands);
+            if let Some(redirects) = file_read {
+                // `$(<file)` / `$(< file)`: bash's shorthand for `$(cat file)`
+                // (#2448). A bare input redirect would otherwise run an empty
+                // command and produce nothing.
+                let read = if self.logic_only_redirect_error(redirects).is_some() {
+                    Err(crate::error::Error::CommandFailure(String::new()))
+                } else {
+                    self.process_input_redirections(None, redirects).await
+                };
+                match read {
+                    Ok(content) => {
+                        if let Some(content) = content {
+                            stdout.push_str(&content.command_substitution_text());
+                        }
+                        self.last_exit_code = 0;
+                    }
+                    Err(crate::error::Error::CommandFailure(_)) => {
+                        self.last_exit_code = 1;
+                    }
+                    Err(e) => return Err(e),
+                }
+            }
+            let commands: &[Command] = if file_read.is_some() { &[] } else { commands };
             for cmd in commands {
                 let cmd_result = self.execute_command(cmd).await?;
                 stdout.push_str(&cmd_result.stdout.command_substitution_text());
@@ -9406,17 +9489,13 @@ impl Interpreter {
                         if self.counters.push_subst(&self.limits).is_err() {
                             result.push('0');
                         } else {
-                            let snapshot = self.snapshot_subshell_state();
-                            let cmd_result =
-                                self.execute_command_sequence(&script.commands).await?;
-                            self.restore_subshell_state(snapshot);
-                            self.counters.pop_subst();
-                            let command_output = cmd_result.stdout.command_substitution_text();
-                            let trimmed = command_output.trim_end_matches('\n');
+                            // Same subshell semantics as `$(...)` in words,
+                            // including the `$(<file)` shorthand.
+                            let trimmed = self.execute_cmd_subst(&script.commands).await?;
                             if trimmed.is_empty() {
                                 result.push('0');
                             } else {
-                                result.push_str(trimmed);
+                                result.push_str(&trimmed);
                             }
                         }
                     }
diff --git a/crates/bashkit/src/parser/mod.rs b/crates/bashkit/src/parser/mod.rs
index 80935c4ea..69e7d31fd 100644
--- a/crates/bashkit/src/parser/mod.rs
+++ b/crates/bashkit/src/parser/mod.rs
@@ -2812,8 +2812,10 @@ impl<'a> Parser<'a> {
             }
         }
 
-        // Handle assignment-only commands (VAR=value with no command)
-        if words.is_empty() && !assignments.is_empty() {
+        // Handle assignment-only and redirect-only commands (`VAR=value`,
+        // `< file`, `> file`): bash runs them as null commands that still
+        // perform their assignments/redirections (#2448: `$(<file)`).
+        if words.is_empty() && (!assignments.is_empty() || !redirects.is_empty()) {
             return Ok(Some(SimpleCommand {
                 name: Word::literal(""),
                 args: Vec::new(),
diff --git a/crates/bashkit/tests/spec_cases/bash/command-subst.test.sh b/crates/bashkit/tests/spec_cases/bash/command-subst.test.sh
index 430e1086c..6dfa927db 100644
--- a/crates/bashkit/tests/spec_cases/bash/command-subst.test.sh
+++ b/crates/bashkit/tests/spec_cases/bash/command-subst.test.sh
@@ -253,3 +253,67 @@ echo "$x"
 ### expect
 ok
 ### end
+
+### subst_file_read_shorthand
+# $(<file) reads the file like $(cat file) (issue #2448)
+echo hi > /tmp/cs_read
+x=$(</tmp/cs_read)
+echo "[$x]"
+### expect
+[hi]
+### end
+
+### subst_file_read_shorthand_space
+# $(< file) with a space and multi-line content; trailing newlines trimmed
+printf 'a\nb\n\n' > /tmp/cs_read2
+x=$(< /tmp/cs_read2)
+echo "[$x]"
+### expect
+[a
+b]
+### end
+
+### subst_file_read_shorthand_var_target
+# $(<"$f") expands the target word
+f=/tmp/cs_read3
+echo value > "$f"
+echo "[$(<"$f")]"
+### expect
+[value]
+### end
+
+### subst_file_read_shorthand_missing
+# $(<missing) is empty and sets $? to 1
+{ x=$(</tmp/cs_no_such_file); } 2>/dev/null
+echo "rc=$? [$x]"
+### expect
+rc=1 []
+### end
+
+### subst_file_read_backticks
+# `<file` is the backtick spelling of $(<file)
+echo tick > /tmp/cs_tick
+x=`</tmp/cs_tick`
+echo "[$x]"
+### expect
+[tick]
+### end
+
+### subst_file_read_in_arithmetic
+# $(<file) and $(cat file) inside $(( )) read the file
+echo 5 > /tmp/cs_num
+echo $(( $(</tmp/cs_num) + 1 ))
+echo $(( $(cat /tmp/cs_num) * 2 ))
+### expect
+6
+10
+### end
+
+### subst_file_read_word_split
+# Unquoted $(<file) word-splits like any substitution
+printf 'a b\nc\n' > /tmp/cs_words
+set -- $(</tmp/cs_words)
+echo "$#"
+### expect
+3
+### end
diff --git a/crates/bashkit/tests/spec_cases/bash/pipes-redirects.test.sh b/crates/bashkit/tests/spec_cases/bash/pipes-redirects.test.sh
index 0d76a036b..ffb1fa646 100644
--- a/crates/bashkit/tests/spec_cases/bash/pipes-redirects.test.sh
+++ b/crates/bashkit/tests/spec_cases/bash/pipes-redirects.test.sh
@@ -247,3 +247,41 @@ cat <&3
 ### expect
 start
 ### end
+
+### null_command_output_redirect_truncates
+# A redirect with no command still truncates/creates the file
+echo data > /tmp/nullcmd_out
+> /tmp/nullcmd_out
+wc -c < /tmp/nullcmd_out
+echo "rc=$?"
+### expect
+0
+rc=0
+### end
+
+### null_command_input_redirect_missing
+# A lone input redirect to a missing file fails with status 1
+{ < /tmp/nullcmd_missing; } 2>/dev/null
+echo "rc=$?"
+### expect
+rc=1
+### end
+
+### null_command_redirect_resets_status
+# A successful redirect-only command exits 0
+false
+> /tmp/nullcmd_status
+echo "rc=$?"
+### expect
+rc=0
+### end
+
+### assignment_with_redirect_creates_file
+# x=1 > file assigns and still creates the file
+x=1 > /tmp/nullcmd_assign
+echo "$x"
+test -f /tmp/nullcmd_assign && echo exists
+### expect
+1
+exists
+### end