diff --git a/ansible/roles/decdn_node/README.md b/ansible/roles/decdn_node/README.md
index 992949b..da9620c 100644
--- a/ansible/roles/decdn_node/README.md
+++ b/ansible/roles/decdn_node/README.md
@@ -96,7 +96,7 @@ Per the deCDN node-onboarding ADR (019), a node only serves paid traffic after
    #    `decdn key-gen` writes to ~/.decdn and the node would NOT find its keys.
    sudo -u decdn decdn key-gen \
      --output-dir /var/lib/decdn \
-     --password-file /etc/decdn/keystore.password
+     --keystore-password-file /etc/decdn/keystore.password
    # prints: node id: <NodeId>   eth address: <0x…>
 
    # 3) verify all three are present (the role locks them to 0600 on deploy)
diff --git a/ansible/roles/decdn_node/tasks/main.yml b/ansible/roles/decdn_node/tasks/main.yml
index 66fba20..26648dd 100644
--- a/ansible/roles/decdn_node/tasks/main.yml
+++ b/ansible/roles/decdn_node/tasks/main.yml
@@ -1168,7 +1168,7 @@
     cmd: >-
       {{ decdn_cli_bin }} key-gen
       --output-dir {{ decdn_home }}
-      --password-file {{ decdn_keystore_password_file }}
+      --keystore-password-file {{ decdn_keystore_password_file }}
     creates: "{{ decdn_keystore_file }}"
   become: true
   become_user: "{{ decdn_user }}"
@@ -1222,7 +1222,7 @@
         openssl rand -base64 32 | sudo -u {{ decdn_user }} tee {{ decdn_keystore_password_file }} >/dev/null
         sudo -u {{ decdn_user }} chmod 600 {{ decdn_keystore_password_file }}
         sudo -u {{ decdn_user }} decdn key-gen \
-          --output-dir {{ decdn_home }} --password-file {{ decdn_keystore_password_file }}
+          --output-dir {{ decdn_home }} --keystore-password-file {{ decdn_keystore_password_file }}
       Pass --output-dir {{ decdn_home }} explicitly: a bare `decdn key-gen` writes to
       ~/.decdn and the node would not find its keys. That writes node.secret +
       keystore.json and prints the NodeId + eth address; fund + stake that address per