diff --git a/cmd/sanssh/client/client.go b/cmd/sanssh/client/client.go
index 3b49b4a9..5037282d 100644
--- a/cmd/sanssh/client/client.go
+++ b/cmd/sanssh/client/client.go
@@ -54,7 +54,8 @@ func init() {
 // to run a sansssh command.
 type RunState struct {
 	// Proxy is an optional proxy server to route requests.
-	Proxy string
+	Proxy                  string
+	ProxyAuthorityOverride string
 	// Targets is a list of remote targets to use when a proxy
 	// is in use. For non proxy must be 1 entry.
 	Targets []string
@@ -285,6 +286,10 @@ func Run(ctx context.Context, rs RunState) {
 		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(16 * 1024 * 1024)),
 	}
 
+	if rs.Proxy != "" && rs.ProxyAuthorityOverride != "" {
+		ops = append(ops, grpc.WithAuthority(rs.ProxyAuthorityOverride))
+	}
+
 	if rs.PerRPCCredentials != nil {
 		ops = append(ops, grpc.WithPerRPCCredentials(rs.PerRPCCredentials))
 	}
diff --git a/cmd/sanssh/main.go b/cmd/sanssh/main.go
index a209174e..eb1ad942 100644
--- a/cmd/sanssh/main.go
+++ b/cmd/sanssh/main.go
@@ -75,6 +75,7 @@ var (
 %s in the environment can also be set instead of setting this flag. The flag will take precedence.
 If blank a direct connection to the first entry in --targets will be made.
 If port is blank the default of %d will be used`, proxyEnv, defaultProxyPort))
+	proxyAuthorityOverride = flag.String("proxy-authority-override", "", "Authority override to use when dialing the proxy (passed to grpc.WithAuthority when set)")
 	// Deprecated: --timeout flag is deprecated. Use --idle-timeout or --dial-timeout instead
 	_                = flag.Duration("timeout", defaultDialTimeout, "DEPRECATED. Please use --idle-timeout or --dial-timeout instead")
 	dialTimeout      = flag.Duration("dial-timeout", defaultDialTimeout, "How long to wait for the connection to be accepted. Timeout specified in --targets or --proxy will take precedence")
@@ -209,17 +210,18 @@ func main() {
 	}
 
 	rs := client.RunState{
-		Proxy:             *proxyAddr,
-		Targets:           *targetsFlag.Target,
-		Outputs:           *outputsFlag.Target,
-		AuthzDryRun:       *authzDryRun,
-		OutputsDir:        *outputsDir,
-		CredSource:        *credSource,
-		IdleTimeout:       *idleTimeout,
-		ClientAuthzPolicy: clientPolicy,
-		PrefixOutput:      *prefixHeader,
-		BatchSize:         *batchSize,
-		EnableMPA:         *mpa,
+		Proxy:                  *proxyAddr,
+		ProxyAuthorityOverride: *proxyAuthorityOverride,
+		Targets:                *targetsFlag.Target,
+		Outputs:                *outputsFlag.Target,
+		AuthzDryRun:            *authzDryRun,
+		OutputsDir:             *outputsDir,
+		CredSource:             *credSource,
+		IdleTimeout:            *idleTimeout,
+		ClientAuthzPolicy:      clientPolicy,
+		PrefixOutput:           *prefixHeader,
+		BatchSize:              *batchSize,
+		EnableMPA:              *mpa,
 	}
 
 	if *justification != "" {