diff --git a/go/flags/endtoend/vtbench.txt b/go/flags/endtoend/vtbench.txt
index 7b0d72af429..616f873c294 100644
--- a/go/flags/endtoend/vtbench.txt
+++ b/go/flags/endtoend/vtbench.txt
@@ -50,6 +50,17 @@ Flags:
       --config-type string                                          Config file type (omit to infer config type from file extension).
       --count int                                                   Number of queries per thread (default 1000)
       --db string                                                   Database name to use when connecting / running the queries (e.g. @replica, keyspace, keyspace/shard etc)
+      --db-credentials-file string                                  db credentials file; send SIGHUP to reload this file
+      --db-credentials-server string                                db credentials server type ('file' - file implementation; 'vault' - HashiCorp Vault implementation) (default "file")
+      --db-credentials-vault-addr string                            URL to Vault server
+      --db-credentials-vault-path string                            Vault path to credentials JSON blob, e.g.: secret/data/prod/dbcreds
+      --db-credentials-vault-role-mountpoint string                 Vault AppRole mountpoint; can also be passed using VAULT_MOUNTPOINT environment variable (default "approle")
+      --db-credentials-vault-role-secretidfile string               Path to file containing Vault AppRole secret_id; can also be passed using VAULT_SECRETID environment variable
+      --db-credentials-vault-roleid string                          Vault AppRole id; can also be passed using VAULT_ROLEID environment variable
+      --db-credentials-vault-timeout duration                       Timeout for vault API operations (default 10s)
+      --db-credentials-vault-tls-ca string                          Path to CA PEM for validating Vault server certificate
+      --db-credentials-vault-tokenfile string                       Path to file containing Vault auth token; token can also be passed using VAULT_TOKEN environment variable
+      --db-credentials-vault-ttl duration                           How long to cache DB credentials from the Vault server (default 30m0s)
       --deadline duration                                           Maximum duration for the test run (default 5 minutes) (default 5m0s)
       --grpc_auth_static_client_creds string                        When using grpc_static_auth in the server, this file provides the credentials to use to authenticate with server.
       --grpc_compression string                                     Which protocol to use for compressing gRPC. Default: nothing. Supported: snappy
diff --git a/go/vt/dbconfigs/credentials.go b/go/vt/dbconfigs/credentials.go
index f7082738c5e..ecc094b9cc0 100644
--- a/go/vt/dbconfigs/credentials.go
+++ b/go/vt/dbconfigs/credentials.go
@@ -60,6 +60,7 @@ var (
 		"mysqlctl",
 		"mysqlctld",
 		"vtbackup",
+		"vtbench",
 		"vtcombo",
 		"vttablet",
 	}