diff --git a/src/ex_getln.c b/src/ex_getln.c
index 80f210a..9a8806c 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -462,7 +462,7 @@
 	incsearch_state_T   *is_state)
 {
     int		skiplen, patlen;
-    int		i;
+    int		found;  // do_search() result
     pos_T	end_pos;
     struct cmdline_info	save_ccline;
 #ifdef FEAT_RELTIME
@@ -508,7 +508,7 @@
     // If there is no pattern, don't do anything.
     if (patlen == 0 && !use_last_pat)
     {
-	i = 0;
+	found = 0;
 	set_no_hlsearch(TRUE); // turn off previous highlight
 	redraw_all_later(SOME_VALID);
     }
@@ -528,7 +528,7 @@
 	if (search_first_line != 0)
 	    search_flags += SEARCH_START;
 	ccline.cmdbuff[skiplen + patlen] = NUL;
-	i = do_search(NULL, firstc == ':' ? '/' : firstc,
+	found = do_search(NULL, firstc == ':' ? '/' : firstc,
 				 ccline.cmdbuff + skiplen, count, search_flags,
 #ifdef FEAT_RELTIME
 		&tm, NULL
@@ -543,7 +543,7 @@
 		|| curwin->w_cursor.lnum > search_last_line)
 	{
 	    // match outside of address range
-	    i = 0;
+	    found = 0;
 	    curwin->w_cursor = is_state->search_start;
 	}
 
@@ -552,13 +552,13 @@
 	{
 	    (void)vpeekc();	// remove <C-C> from input stream
 	    got_int = FALSE;	// don't abandon the command line
-	    i = 0;
+	    found = 0;
 	}
 	else if (char_avail())
 	    // cancelled searching because a char was typed
 	    is_state->incsearch_postponed = TRUE;
     }
-    if (i != 0)
+    if (found != 0)
 	highlight_match = TRUE;		// highlight position
     else
 	highlight_match = FALSE;	// remove highlight
@@ -569,7 +569,7 @@
     changed_cline_bef_curs();
     update_topline();
 
-    if (i != 0)
+    if (found != 0)
     {
 	pos_T	    save_pos = curwin->w_cursor;
 
@@ -604,8 +604,11 @@
     restore_cmdline(&save_ccline);
     restore_last_search_pattern();
 
-    // Leave it at the end to make CTRL-R CTRL-W work.
-    if (i != 0)
+    // Leave it at the end to make CTRL-R CTRL-W work.  But not when beyond the
+    // end of the pattern, e.g. for ":s/pat/".
+    if (ccline.cmdbuff[skiplen + patlen] != NUL)
+	curwin->w_cursor = is_state->search_start;
+    else if (found != 0)
 	curwin->w_cursor = end_pos;
 
     msg_starthere();
diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
index f96e54a..79f8645 100644
--- a/src/testdir/test_search.vim
+++ b/src/testdir/test_search.vim
@@ -1060,6 +1060,42 @@
   set noincsearch
 endfunc
 
+func Test_word_under_cursor_after_match()
+  if !exists('+incsearch')
+    return
+  endif
+  new
+  call setline(1, 'foo bar')
+  set incsearch
+  call test_override("char_avail", 1)
+  try
+    call feedkeys("/foo\<C-R>\<C-W>\<CR>", 'ntx')
+  catch /E486:/
+  endtry
+  call assert_equal('foobar', @/)
+
+  bwipe!
+  call test_override("ALL", 0)
+  set noincsearch
+endfunc
+
+func Test_subst_word_under_cursor()
+  if !exists('+incsearch')
+    return
+  endif
+  new
+  call setline(1, ['int SomeLongName;', 'for (xxx = 1; xxx < len; ++xxx)'])
+  set incsearch
+  call test_override("char_avail", 1)
+  call feedkeys("/LongName\<CR>", 'ntx')
+  call feedkeys(":%s/xxx/\<C-R>\<C-W>/g\<CR>", 'ntx')
+  call assert_equal('for (SomeLongName = 1; SomeLongName < len; ++SomeLongName)', getline(2))
+
+  bwipe!
+  call test_override("ALL", 0)
+  set noincsearch
+endfunc
+
 func Test_search_undefined_behaviour()
   if !has("terminal")
     return
diff --git a/src/version.c b/src/version.c
index 26825b9..b3b4716 100644
--- a/src/version.c
+++ b/src/version.c
@@ -795,6 +795,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    356,
+/**/
     355,
 /**/
     354,