diff --git a/lib/hx509/hxtool-commands.in b/lib/hx509/hxtool-commands.in
index 95af5fc84..2dd272b4f 100644
--- a/lib/hx509/hxtool-commands.in
+++ b/lib/hx509/hxtool-commands.in
@@ -48,6 +48,12 @@ command = {
 		argument = "signer-friendly-name"
 		help = "certificate to sign with"
 	}
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	option = {
 		long = "content-info"
 		type = "flag"
@@ -73,6 +79,12 @@ command = {
 		argument = "certificate-store"
 		help = "certificate store to pull certificates from"
 	}
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	option = {
 		long = "content-info"
 		type = "flag"
@@ -92,6 +104,12 @@ command = {
 		argument = "certificate-store"
 		help = "certificate used to decrypt the data"
 	}
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	option = {
 		long = "content-info"
 		type = "flag"
@@ -111,6 +129,12 @@ command = {
 		argument = "certificate-store"
 		help = "certificate used to encrypt the data"
 	}
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	option = {
 		long = "content-info"
 		type = "flag"
@@ -123,6 +147,12 @@ command = {
 command = {
 	name = "verify"
 	function = "pcert_verify"
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	option = {
 		long = "verbose"
 		short = "v"
@@ -135,6 +165,12 @@ command = {
 command = {
 	name = "print"
 	function = "pcert_print"
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	min_args="1"
 	argument="certificate ..."
 	help = "Print certificates"
@@ -142,6 +178,12 @@ command = {
 command = {
 	name = "validate"
 	function = "pcert_validate"
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	min_args="1"
 	argument="certificate ..."
 	help = "Validate content of certificates"
@@ -171,6 +213,12 @@ command = {
 		argument = "name"
 		help = "match on friendly name"
 	}
+	option = {
+		long = "pass"
+		type = "strings"
+		argument = "password"
+		help = "password, prompter, or environment"
+	}
 	min_args="1"
 	argument="certificates ..."
 	help = "Query the certificates for a match"