diff --git a/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root.go b/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root.go
index 21ea1f1fd..2897b27bf 100644
--- a/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root.go
+++ b/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root.go
@@ -18,6 +18,8 @@ limitations under the License.
 package cli
 
 import (
+	"os"
+
 	"github.com/NVIDIA/nvcf/src/control-plane-services/nats-auth-callout/internal/config"
 	"github.com/spf13/cobra"
 )
@@ -27,9 +29,19 @@ func SetEmbeddedConfig(configData []byte) {
 	config.SetEmbeddedDefaults(configData)
 }
 
+// commandArgs returns the args to pass to the root command.
+// When invoked with no subcommand (container default), it defaults to ["server"].
+func commandArgs() []string {
+	if len(os.Args) < 2 {
+		return []string{"server"}
+	}
+	return os.Args[1:]
+}
+
 // Execute runs the root command
 func Execute() error {
 	rootCmd := NewRootCommand()
+	rootCmd.SetArgs(commandArgs())
 	return rootCmd.Execute()
 }
 
diff --git a/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root_test.go b/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root_test.go
index b111f69c1..4b0e6c2a3 100644
--- a/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root_test.go
+++ b/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/cli/root_test.go
@@ -18,6 +18,7 @@ limitations under the License.
 package cli
 
 import (
+	"os"
 	"testing"
 )
 
@@ -32,7 +33,6 @@ func TestNewRootCommand(t *testing.T) {
 	if len(cmd.Commands()) == 0 {
 		t.Error("Expected at least one subcommand to be added")
 	}
-	// Check that the subcommand is 'server'
 	found := false
 	for _, c := range cmd.Commands() {
 		if c.Use == "server" {
@@ -43,3 +43,33 @@ func TestNewRootCommand(t *testing.T) {
 		t.Error("Expected 'server' subcommand to be present")
 	}
 }
+
+func TestCommandArgsDefaultsToServer(t *testing.T) {
+	old := os.Args
+	os.Args = []string{"nvcf-nats-auth-callout-service"}
+	defer func() { os.Args = old }()
+
+	args := commandArgs()
+	if len(args) != 1 || args[0] != "server" {
+		t.Errorf("expected [\"server\"], got %v", args)
+	}
+
+	cmd, _, err := NewRootCommand().Traverse(args)
+	if err != nil {
+		t.Fatalf("unexpected traversal error: %v", err)
+	}
+	if cmd.Use != "server" {
+		t.Errorf("expected server command, got %q", cmd.Use)
+	}
+}
+
+func TestCommandArgsPassesExplicitArgs(t *testing.T) {
+	old := os.Args
+	os.Args = []string{"nvcf-nats-auth-callout-service", "version"}
+	defer func() { os.Args = old }()
+
+	args := commandArgs()
+	if len(args) != 1 || args[0] != "version" {
+		t.Errorf("expected [\"version\"], got %v", args)
+	}
+}
diff --git a/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/main_test.go b/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/main_test.go
index 0050fc60c..d75afe48d 100644
--- a/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/main_test.go
+++ b/src/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/main_test.go
@@ -17,11 +17,17 @@ limitations under the License.
 
 package main
 
-import "testing"
+import (
+	"os"
+	"testing"
+)
 
-// TestMainFunction ensures the main function runs without error.
+// TestMainFunction ensures the main function runs without panicking for a known-safe subcommand.
 func TestMainFunction(t *testing.T) {
+	old := os.Args
+	os.Args = []string{"nvcf-nats-auth-callout-service", "version"}
 	defer func() {
+		os.Args = old
 		if r := recover(); r != nil {
 			t.Errorf("main() panicked with error: %v", r)
 		}