diff --git a/switch_backend.py b/switch_backend.py
index dedb207..89f9b80 100644
--- a/switch_backend.py
+++ b/switch_backend.py
@@ -314,11 +314,32 @@ def _open_connection() -> paramiko.SSHClient:
 
 
 def read_cmd(cmd: str) -> str:
-    """Run a read-only command via the pool. Invalidates pool on error."""
+    """Run a read-only command in enable mode via interactive shell channel."""
     try:
         conn = _pool.get()
-        _, stdout, _ = conn.exec_command(cmd, timeout=10)
-        return stdout.read().decode("utf-8", errors="replace")
+        ch = conn.invoke_shell()
+        ch.settimeout(10)
+        time.sleep(0.4)
+        if ch.recv_ready():
+            ch.recv(4096)                       # drain login banner
+        for setup in ["terminal length 0", "enable"]:
+            ch.send(setup + "\n")
+            time.sleep(0.3)
+            if ch.recv_ready():
+                ch.recv(4096)                   # drain prompt output
+        ch.send(cmd + "\n")
+        out = ""
+        deadline = time.time() + 8
+        while time.time() < deadline:
+            if ch.recv_ready():
+                out += ch.recv(4096).decode("utf-8", errors="replace")
+                time.sleep(0.1)
+            else:
+                if out:
+                    break
+                time.sleep(0.1)
+        ch.close()
+        return out
     except HTTPException:
         raise
     except Exception as e: