diff --git a/classes/PodsForm.php b/classes/PodsForm.php
index 0c5ca70319..641070c592 100644
--- a/classes/PodsForm.php
+++ b/classes/PodsForm.php
@@ -1440,6 +1440,15 @@ public static function default_value( $value, $type = 'text', $name = null, $opt
 			if ( $default !== $default_value && 1 === (int) pods_v( 'default_evaluate_tags', $options, 1 ) ) {
 				$default = pods_evaluate_tags( $default );
 			}
+
+			// Shortcode expansion is a separate opt-in from magic tag evaluation, so it must not
+			// be nested within the magic tag check above -- a default containing only a shortcode
+			// still needs to be expanded. This intentionally runs before the
+			// default_value_parameter override below so that request-supplied values are never
+			// passed through do_shortcode().
+			if ( 1 === (int) pods_v( $type . '_allow_shortcode', $options, 0 ) ) {
+				$default = do_shortcode( $default );
+			}
 		}
 
 		$default_value_parameter = pods_v( 'default_value_parameter', $options );
diff --git a/tests/codeception/wpunit/Pods/PodsFormTest.php b/tests/codeception/wpunit/Pods/PodsFormTest.php
new file mode 100644
index 0000000000..1320544f45
--- /dev/null
+++ b/tests/codeception/wpunit/Pods/PodsFormTest.php
@@ -0,0 +1,174 @@
+<?php
+
+namespace Pods_Unit_Tests\Pods;
+
+use Pods_Unit_Tests\Pods_UnitTestCase;
+use PodsForm;
+
+/**
+ * @group   pods-form
+ * @coversDefaultClass PodsForm
+ */
+class PodsFormTest extends Pods_UnitTestCase {
+
+	public function tearDown(): void {
+		parent::tearDown();
+
+		if ( shortcode_exists( 'fooshortcode' ) ) {
+			remove_shortcode( 'fooshortcode' );
+		}
+	}
+
+	/**
+	 * @covers PodsForm::default_value
+	 */
+	public function test_default_value_evaluates_shortcode_when_allow_shortcode_is_on() {
+		add_shortcode( 'fooshortcode', static function () {
+			return 'foobar';
+		} );
+
+		$value = PodsForm::default_value(
+			'',
+			'text',
+			'my_field',
+			array(
+				'default'              => '[fooshortcode]',
+				'text_allow_shortcode' => 1,
+			)
+		);
+
+		$this->assertSame( 'foobar', $value );
+	}
+
+	/**
+	 * @covers PodsForm::default_value
+	 */
+	public function test_default_value_keeps_shortcode_literal_when_allow_shortcode_is_off() {
+		add_shortcode( 'fooshortcode', static function () {
+			return 'foobar';
+		} );
+
+		$value = PodsForm::default_value(
+			'',
+			'text',
+			'my_field',
+			array(
+				'default'              => '[fooshortcode]',
+				'text_allow_shortcode' => 0,
+			)
+		);
+
+		$this->assertSame( '[fooshortcode]', $value );
+	}
+
+	/**
+	 * @covers PodsForm::default_value
+	 */
+	public function test_default_value_keeps_unknown_shortcode_literal_even_when_allow_shortcode_is_on() {
+		$value = PodsForm::default_value(
+			'',
+			'text',
+			'my_field',
+			array(
+				'default'              => 'Hello [unregistered] world',
+				'text_allow_shortcode' => 1,
+			)
+		);
+
+		$this->assertSame( 'Hello [unregistered] world', $value );
+	}
+
+	/**
+	 * @covers PodsForm::default_value
+	 */
+	public function test_default_value_does_not_evaluate_shortcode_for_field_types_without_allow_shortcode() {
+		add_shortcode( 'fooshortcode', static function () {
+			return 'foobar';
+		} );
+
+		$value = PodsForm::default_value(
+			'',
+			'pick',
+			'my_field',
+			array( 'default' => '[fooshortcode]' )
+		);
+
+		$this->assertSame( '[fooshortcode]', $value );
+	}
+
+	/**
+	 * @covers PodsForm::default_value
+	 */
+	public function test_default_value_keeps_request_supplied_value_literal_even_when_allow_shortcode_is_on() {
+		add_shortcode( 'fooshortcode', static function () {
+			return 'foobar';
+		} );
+
+		$_GET['my_param'] = '[fooshortcode]';
+
+		$value = PodsForm::default_value(
+			'',
+			'text',
+			'my_field',
+			array(
+				'default'                  => 'static default',
+				'default_value_parameter'  => 'my_param',
+				'text_allow_shortcode'     => 1,
+			)
+		);
+
+		unset( $_GET['my_param'] );
+
+		$this->assertSame( '[fooshortcode]', $value );
+	}
+
+	/**
+	 * Shortcode expansion must not be coupled to magic tag evaluation: a default that
+	 * contains a magic tag AND a shortcode must still have both applied.
+	 *
+	 * @covers PodsForm::default_value
+	 */
+	public function test_default_value_evaluates_both_magic_tags_and_shortcodes() {
+		add_shortcode( 'fooshortcode', static function () {
+			return 'foobar';
+		} );
+
+		$value = PodsForm::default_value(
+			'',
+			'text',
+			'my_field',
+			array(
+				'default'              => '{@user.ID} [fooshortcode]',
+				'text_allow_shortcode' => 1,
+			)
+		);
+
+		$this->assertStringContainsString( 'foobar', $value );
+		$this->assertStringNotContainsString( '[fooshortcode]', $value );
+	}
+
+	/**
+	 * default_evaluate_tags only governs magic tags. Turning it off must not silently
+	 * disable shortcode expansion, which is a separate opt-in.
+	 *
+	 * @covers PodsForm::default_value
+	 */
+	public function test_default_value_evaluates_shortcode_when_tag_evaluation_disabled() {
+		add_shortcode( 'fooshortcode', static function () {
+			return 'foobar';
+		} );
+
+		$value = PodsForm::default_value(
+			'',
+			'text',
+			'my_field',
+			array(
+				'default'               => '[fooshortcode]',
+				'text_allow_shortcode'  => 1,
+				'default_evaluate_tags' => 0,
+			)
+		);
+
+		$this->assertSame( 'foobar', $value );
+	}
+}