diff --git a/commands/base.go b/commands/base.go
index c8ea8656..61db139c 100644
--- a/commands/base.go
+++ b/commands/base.go
@@ -154,9 +154,10 @@ func (e errFromNginx) GoString() string {
 }
 
 // SetupClients configures local and PMM Server API clients.
-func SetupClients(ctx context.Context, serverURL string) {
+func SetupClients(ctx context.Context, serverURL, serverUsername, serverPassword string, serverInsecureTLS bool) {
 	agentlocal.SetTransport(ctx, GlobalFlags.Debug || GlobalFlags.Trace)
 
+	// set server URL
 	if serverURL == "" {
 		status, err := agentlocal.GetStatus(agentlocal.DoNotRequestNetworkInfo)
 		if err != nil {
@@ -189,6 +190,29 @@ func SetupClients(ctx context.Context, serverURL string) {
 		}
 	}
 
+	// override username, password, insecure-tls if given
+	if serverUsername != "" || serverPassword != "" {
+		var newUsername, newPassword string
+		if GlobalFlags.ServerURL.User != nil {
+			newUsername = GlobalFlags.ServerURL.User.Username()
+			newPassword, _ = GlobalFlags.ServerURL.User.Password()
+		}
+		if serverUsername != "" {
+			newUsername = serverUsername
+		}
+		if serverPassword != "" {
+			newPassword = serverPassword
+		}
+		if newPassword != "" {
+			GlobalFlags.ServerURL.User = url.UserPassword(newUsername, newPassword)
+		} else {
+			GlobalFlags.ServerURL.User = url.User(newUsername)
+		}
+	}
+	if serverInsecureTLS {
+		GlobalFlags.ServerInsecureTLS = true
+	}
+
 	// use JSON APIs over HTTP/1.1
 	transport := httptransport.New(GlobalFlags.ServerURL.Host, GlobalFlags.ServerURL.Path, []string{GlobalFlags.ServerURL.Scheme})
 	if u := GlobalFlags.ServerURL.User; u != nil {
diff --git a/commands/config.go b/commands/config.go
index a9c680e0..af0d688f 100644
--- a/commands/config.go
+++ b/commands/config.go
@@ -51,7 +51,8 @@ type configCommand struct {
 	Region    string
 	Az        string
 
-	Force bool
+	Force             bool
+	DontStorePassword bool
 }
 
 func (cmd *configCommand) args() (res []string, switchedToTLS bool) {
@@ -98,6 +99,9 @@ func (cmd *configCommand) args() (res []string, switchedToTLS bool) {
 	if cmd.Force {
 		res = append(res, "--force")
 	}
+	if cmd.DontStorePassword {
+		res = append(res, "--dont-store-password")
+	}
 	res = append(res, cmd.NodeAddress, cmd.NodeType, cmd.NodeName)
 	return //nolint:nakedret
 }
@@ -148,4 +152,5 @@ func init() {
 	ConfigC.Flag("az", "Node availability zone").StringVar(&Config.Az)
 
 	ConfigC.Flag("force", "Remove Node with that name with all dependent Services and Agents if one exist").BoolVar(&Config.Force)
+	ConfigC.Flag("dont-store-password", "Do not store password in configuration file").BoolVar(&Config.DontStorePassword)
 }
diff --git a/main.go b/main.go
index 988337c5..d402520a 100644
--- a/main.go
+++ b/main.go
@@ -42,7 +42,9 @@ func main() {
 	kingpin.CommandLine.UsageTemplate(commands.UsageTemplate)
 
 	serverURLF := kingpin.Flag("server-url", "PMM Server URL in `https://username:password@pmm-server-host/` format").String()
-	kingpin.Flag("server-insecure-tls", "Skip PMM Server TLS certificate validation").BoolVar(&commands.GlobalFlags.ServerInsecureTLS)
+	serverUsernameF := kingpin.Flag("server-username", "Username to connect to PMM Server").String()
+	serverPasswordF := kingpin.Flag("server-password", "Password to connect to PMM Server").String()
+	serverInsecureTLS := kingpin.Flag("server-insecure-tls", "Skip PMM Server TLS certificate validation").Bool()
 	kingpin.Flag("debug", "Enable debug logging").BoolVar(&commands.GlobalFlags.Debug)
 	kingpin.Flag("trace", "Enable trace logging (implies debug)").BoolVar(&commands.GlobalFlags.Trace)
 	jsonF := kingpin.Flag("json", "Enable JSON output").Bool()
@@ -73,7 +75,7 @@ func main() {
 		cancel()
 	}()
 
-	commands.SetupClients(ctx, *serverURLF)
+	commands.SetupClients(ctx, *serverURLF, *serverUsernameF, *serverPasswordF, *serverInsecureTLS)
 
 	allCommands := map[string]commands.Command{
 		management.RegisterC.FullCommand(): management.Register,