diff --git a/README.md b/README.md
index 1ff4a65..7e45374 100644
--- a/README.md
+++ b/README.md
@@ -81,6 +81,7 @@ These are the attestation type names used in the HTTP headers, and the measureme
 ### Other CLI Options
 
 - `--pccs-url` selects the PCCS used to retrieve collateral when verifying DCAP attestations. It defaults to Intel PCS.
+- `--intel-pcs-subscription-key <KEY>` (or `INTEL_PCS_SUBSCRIPTION_KEY`) supplies an API key for Intel PCS when verifying DCAP attestations. The CLI flag takes precedence over the environment variable. This global option is mutually exclusive with `--pccs-url`.
 - `client`, `get-tls-cert`, and `attested-get` accept `--allow-self-signed` to permit a self-signed remote TLS certificate.
 - `client` and `server` accept `--listen-addr-healthcheck` to start a separate HTTP health-check listener.
 - `client --request-timeout-secs` sets the deadline from receipt of request headers through queueing, upload, and receipt of response headers (default: 60 seconds). Expired requests receive HTTP 504 and are not retried. If a response has already started, an unfinished upload is canceled at the deadline; its response status cannot be changed. Response bodies can continue streaming after that deadline once the upload completes.
diff --git a/crates/attested-tls-proxy/src/cli/attestation.rs b/crates/attested-tls-proxy/src/cli/attestation.rs
index 5a0822a..c92ff51 100644
--- a/crates/attested-tls-proxy/src/cli/attestation.rs
+++ b/crates/attested-tls-proxy/src/cli/attestation.rs
@@ -7,6 +7,7 @@ pub(super) async fn build_verifier(
     measurements_file: Option<String>,
     allowed_remote_attestation_type: Option<String>,
     pccs_url: Option<String>,
+    intel_pcs_subscription_key: Option<String>,
     log_dcap_quote: bool,
     override_azure_outdated_tcb: bool,
 ) -> anyhow::Result<AttestationVerifier> {
@@ -44,5 +45,9 @@ pub(super) async fn build_verifier(
     if let Some(pccs_url) = pccs_url {
         attestation_verifier_builder = attestation_verifier_builder.with_pccs_url(pccs_url);
     }
+    if let Some(key) = intel_pcs_subscription_key {
+        attestation_verifier_builder =
+            attestation_verifier_builder.with_intel_pcs_subscription_key(key);
+    }
     Ok(attestation_verifier_builder.build())
 }
diff --git a/crates/attested-tls-proxy/src/cli/mod.rs b/crates/attested-tls-proxy/src/cli/mod.rs
index 2e39fd4..b044e2b 100644
--- a/crates/attested-tls-proxy/src/cli/mod.rs
+++ b/crates/attested-tls-proxy/src/cli/mod.rs
@@ -4,7 +4,7 @@ mod pem;
 mod tcp_tunnel;
 
 use anyhow::ensure;
-use clap::{Parser, Subcommand};
+use clap::{Parser, Subcommand, builder::TypedValueParser};
 
 const GIT_REV: &str = match option_env!("GIT_REV") {
     Some(rev) => rev,
@@ -25,6 +25,16 @@ pub(crate) struct Cli {
     /// The URL of a PCCS to use when verifying DCAP attestations. Defaults to Intel PCS.
     #[arg(long, global = true)]
     pccs_url: Option<String>,
+    /// Intel PCS subscription key to use when verifying DCAP attestations
+    #[arg(
+        long,
+        global = true,
+        env = "INTEL_PCS_SUBSCRIPTION_KEY",
+        hide_env_values = true,
+        value_parser = clap::builder::StringValueParser::new().map(|key| key.trim().to_owned()),
+        conflicts_with = "pccs_url"
+    )]
+    intel_pcs_subscription_key: Option<String>,
     /// Log debug messages
     #[arg(long, global = true)]
     pub(crate) log_debug: bool,
@@ -73,6 +83,7 @@ impl Cli {
             self.measurements_file,
             self.allowed_remote_attestation_type,
             self.pccs_url,
+            self.intel_pcs_subscription_key,
             self.log_dcap_quote,
             self.override_azure_outdated_tcb,
         )