diff --git a/packages/cli/src/cmds/validator/handler.ts b/packages/cli/src/cmds/validator/handler.ts
index a98eb0755ad0..cb3191d07a7d 100644
--- a/packages/cli/src/cmds/validator/handler.ts
+++ b/packages/cli/src/cmds/validator/handler.ts
@@ -200,9 +200,10 @@ export async function validatorHandler(args: IValidatorCliArgs & GlobalArgs): Pr
         address: args["keymanager.address"],
         port: args["keymanager.port"],
         cors: args["keymanager.cors"],
-        isAuthEnabled: args["keymanager.authEnabled"],
+        isAuthEnabled: args["keymanager.auth"],
         headerLimit: args["keymanager.headerLimit"],
         bodyLimit: args["keymanager.bodyLimit"],
+        tokenFile: args["keymanager.tokenFile"],
         tokenDir: dbPath,
       },
       {config, logger, api: keymanagerApi, metrics: metrics ? metrics.keymanagerApiRest : null}
diff --git a/packages/cli/src/cmds/validator/keymanager/server.ts b/packages/cli/src/cmds/validator/keymanager/server.ts
index dacb32dd600c..6d2498dfbb2f 100644
--- a/packages/cli/src/cmds/validator/keymanager/server.ts
+++ b/packages/cli/src/cmds/validator/keymanager/server.ts
@@ -13,6 +13,8 @@ import {writeFile600Perm} from "../../../util/index.js";
 export type KeymanagerRestApiServerOpts = RestApiServerOpts & {
   isAuthEnabled: boolean;
   tokenDir?: string;
+  // Takes precedence over `tokenDir`
+  tokenFile?: string;
 };
 
 export const keymanagerRestApiServerOptsDefault: KeymanagerRestApiServerOpts = {
@@ -44,7 +46,9 @@ export class KeymanagerRestApiServer extends RestApiServer {
       ...Object.fromEntries(Object.entries(optsArg).filter(([_, v]) => v != null)),
     };
 
-    const apiTokenPath = path.join(opts.tokenDir ?? ".", apiTokenFileName);
+    const apiTokenPath = opts.tokenFile
+      ? path.resolve(opts.tokenFile)
+      : path.join(opts.tokenDir ?? ".", apiTokenFileName);
     let bearerToken: string | undefined;
 
     if (opts.isAuthEnabled) {
diff --git a/packages/cli/src/cmds/validator/options.ts b/packages/cli/src/cmds/validator/options.ts
index 7fdcdec59e86..7ffc8371a999 100644
--- a/packages/cli/src/cmds/validator/options.ts
+++ b/packages/cli/src/cmds/validator/options.ts
@@ -78,7 +78,8 @@ export type IValidatorCliArgs = AccountValidatorArgs &
 
 export type KeymanagerArgs = {
   keymanager?: boolean;
-  "keymanager.authEnabled"?: boolean;
+  "keymanager.auth"?: boolean;
+  "keymanager.tokenFile"?: string;
   "keymanager.port"?: number;
   "keymanager.address"?: string;
   "keymanager.cors"?: string;
@@ -93,12 +94,18 @@ export const keymanagerOptions: CliCommandOptions<KeymanagerArgs> = {
     default: false,
     group: "keymanager",
   },
-  "keymanager.authEnabled": {
+  "keymanager.auth": {
+    alias: ["keymanager.authEnabled"],
     type: "boolean",
     description: "Enable token bearer authentication for key manager API server",
     default: true,
     group: "keymanager",
   },
+  "keymanager.tokenFile": {
+    type: "string",
+    description: "Path to file containing bearer token used for key manager API authentication",
+    group: "keymanager",
+  },
   "keymanager.port": {
     type: "number",
     description: "Set port for key manager API",
diff --git a/packages/cli/test/e2e/voluntaryExitFromApi.test.ts b/packages/cli/test/e2e/voluntaryExitFromApi.test.ts
index ed4439d36ab2..271f3d794ca3 100644
--- a/packages/cli/test/e2e/voluntaryExitFromApi.test.ts
+++ b/packages/cli/test/e2e/voluntaryExitFromApi.test.ts
@@ -35,7 +35,7 @@ describe("voluntary exit from api", function () {
         "--keymanager",
         `--keymanager.port=${keymanagerPort}`,
         // Disable bearer token auth to simplify testing
-        "--keymanager.authEnabled=false",
+        "--keymanager.auth=false",
       ],
       {pipeStdioToParent: false, logPrefix: "dev", testContext: {beforeEach, afterEach, afterAll}}
     );
diff --git a/packages/cli/test/utils/simulation/validator_clients/lodestar.ts b/packages/cli/test/utils/simulation/validator_clients/lodestar.ts
index 44c2763dacf4..03843796a6bb 100644
--- a/packages/cli/test/utils/simulation/validator_clients/lodestar.ts
+++ b/packages/cli/test/utils/simulation/validator_clients/lodestar.ts
@@ -30,7 +30,7 @@ export const generateLodestarValidatorNode: ValidatorNodeGenerator<ValidatorClie
     dataDir: rootDir,
     server: beaconUrls,
     keymanager: true,
-    "keymanager.authEnabled": false,
+    "keymanager.auth": false,
     "keymanager.address": "127.0.0.1",
     "keymanager.port": ports.validator.keymanagerPort,
     logPrefix: id,