diff --git a/internal/client/client.go b/internal/client/client.go
index 8297b32d..b2b7ce53 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -108,5 +108,10 @@ func DialOptsFromFlags(cmd *cobra.Command, token storage.Token) ([]grpc.DialOpti
 		opts = append(opts, certOpt)
 	}
 
+	hostnameOverride := cobrautil.MustGetString(cmd, "hostname-override")
+	if hostnameOverride != "" {
+		opts = append(opts, grpc.WithAuthority(hostnameOverride))
+	}
+
 	return opts, nil
 }
diff --git a/internal/cmd/cmd.go b/internal/cmd/cmd.go
index fe087777..a5846fcc 100644
--- a/internal/cmd/cmd.go
+++ b/internal/cmd/cmd.go
@@ -45,6 +45,7 @@ func Run() {
 
 	rootCmd.PersistentFlags().String("endpoint", "", "spicedb gRPC API endpoint")
 	rootCmd.PersistentFlags().String("permissions-system", "", "permissions system to query")
+	rootCmd.PersistentFlags().String("hostname-override", "", "override the hostname used in the connection to the endpoint")
 	rootCmd.PersistentFlags().String("token", "", "token used to authenticate to SpiceDB")
 	rootCmd.PersistentFlags().String("certificate-path", "", "path to certificate authority used to verify secure connections")
 	rootCmd.PersistentFlags().Bool("insecure", false, "connect over a plaintext connection")