diff --git a/docs/configuration.md b/docs/configuration.md
index 4d03b907b..7ef6bbd74 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -532,6 +532,7 @@ Auth and Tailscale:
 Remote client defaults (CLI):
 - `gateway.remote.url` sets the default Gateway WebSocket URL for CLI calls when `gateway.mode = "remote"`.
 - `gateway.remote.token` supplies the token for remote calls (leave unset for no auth).
+- `gateway.remote.password` supplies the password for remote calls (leave unset for no auth).
 
 ```json5
 {
@@ -539,7 +540,8 @@ Remote client defaults (CLI):
     mode: "remote",
     remote: {
       url: "ws://gateway.tailnet:18789",
-      token: "your-token"
+      token: "your-token",
+      password: "your-password"
     }
   }
 }
diff --git a/src/config/config.ts b/src/config/config.ts
index 1e9f56353..2539aeb3d 100644
--- a/src/config/config.ts
+++ b/src/config/config.ts
@@ -308,6 +308,8 @@ export type GatewayRemoteConfig = {
   url?: string;
   /** Token for remote auth (when the gateway requires token auth). */
   token?: string;
+  /** Password for remote auth (when the gateway requires password auth). */
+  password?: string;
 };
 
 export type GatewayConfig = {
@@ -973,6 +975,7 @@ const ClawdisSchema = z.object({
         .object({
           url: z.string().optional(),
           token: z.string().optional(),
+          password: z.string().optional(),
         })
         .optional(),
     })