diff --git a/doc/man-pages/pod1/pts.pod b/doc/man-pages/pod1/pts.pod
index d3a890b053..1a3a009c8e 100644
--- a/doc/man-pages/pod1/pts.pod
+++ b/doc/man-pages/pod1/pts.pod
@@ -195,6 +195,16 @@ L<pts_interactive(1)>, since otherwise it would be impossible to switch from,
 for example, B<-localauth> back to using regular tokens during a bulk
 operation. See L<pts_interactive(1)> for more details.
 
+=item B<-rxgk> (crypt | auth | clear)
+
+Specify B<-rxgk> to use rxgk credentials when contacting the ptserver. The
+C<crypt> argument causes B<pts> to use rxgk with per-packet encryption, C<auth>
+causes B<pts> to use rxgk with per-packet integrity protection, and C<clear>
+causes B<pts> to use rxgk without any per-packet cryptography.
+
+By default, B<pts> uses rxkad credentials.  B<pts> falls back to unauthenticated
+connections if credentials are not available.
+
 =back
 
 =head1 PRIVILEGE REQUIRED
diff --git a/doc/man-pages/pod1/vos.pod.in b/doc/man-pages/pod1/vos.pod.in
index cf26646a84..3dab98b741 100644
--- a/doc/man-pages/pod1/vos.pod.in
+++ b/doc/man-pages/pod1/vos.pod.in
@@ -263,6 +263,16 @@ Produces on the standard output stream a detailed trace of the command's
 execution. If this argument is omitted, only warnings and error messages
 appear.
 
+=item B<-rxgk> (crypt | auth | clear)
+
+Specify B<-rxgk> to use rxgk credentials when contacting the vlserver or volserver. The
+C<crypt> argument causes B<vos> to use rxgk with per-packet encryption, C<auth>
+causes B<vos> to use rxgk with per-packet integrity protection, and C<clear>
+causes B<vos> to use rxgk without any per-packet cryptography.
+
+By default, B<vos> uses rxkad credentials.  B<vos> falls back to unauthenticated
+connections if credentials are not available.
+
 =back
 
 =head1 PRIVILEGE REQUIRED
diff --git a/doc/man-pages/pod8/ptserver.pod b/doc/man-pages/pod8/ptserver.pod
index 11e677050d..31c5086dac 100644
--- a/doc/man-pages/pod8/ptserver.pod
+++ b/doc/man-pages/pod8/ptserver.pod
@@ -21,6 +21,7 @@ ptserver S<<< [B<-database> | B<-db> <I<db path>>] >>>
     [B<-transarc-logs>]
     S<<< [B<-config> <I<configuration path>>] >>>
     S<<< [B<-rxmaxmtu> <I<bytes>>] >>>
+    S<< [B<-s2scrypt> (rxgk-crypt | never)] >>
     [B<-help>]
 
 =for html
@@ -194,6 +195,14 @@ L<fileserver(8)> for an explanation of each interface.
 
 Sets the maximum transmission unit for the RX protocol.
 
+=item B<-s2scrypt> (rxgk-crypt | never)
+
+Specify C<rxgk-crypt> to use rxgk connections with per-packet encryption for
+server-to-server (s2s) communication. Specify C<never> to use rxkad connections
+instead, without per-packet encryption ("rxkad_clear").
+
+The default is currently C<never>.
+
 =item B<-help>
 
 Prints the online help for this command. All other valid options are
diff --git a/doc/man-pages/pod8/vlserver.pod b/doc/man-pages/pod8/vlserver.pod
index c74b8bd831..485d772e7d 100644
--- a/doc/man-pages/pod8/vlserver.pod
+++ b/doc/man-pages/pod8/vlserver.pod
@@ -23,6 +23,7 @@ vlserver [B<-noauth>] [B<-smallmem>]
     S<<< [B<-auditlog> <I<log path>>] >>>
     S<<< [B<-audit-interface> (file | sysvmq)] >>>
     S<<< [B<-restricted_query> (anyuser | admin)] >>>
+    S<< [B<-s2scrypt> (rxgk-crypt | never)] >>
     [B<-help>]
 
 =for html
@@ -206,6 +207,14 @@ administrators.  The C<anyuser> option doesn't restrict the RPCs and
 leaves it open for all users including unauthenticated users, this is
 the default.
 
+=item B<-s2scrypt> (rxgk-crypt | never)
+
+Specify C<rxgk-crypt> to use rxgk connections with per-packet encryption for
+server-to-server (s2s) communication. Specify C<never> to use rxkad connections
+instead, without per-packet encryption ("rxkad_clear").
+
+The default is currently C<never>.
+
 =item B<-help>
 
 Prints the online help for this command. All other valid options are