diff --git a/metropolis/cli/metroctl/cmd_install.go b/metropolis/cli/metroctl/cmd_install.go
index fff13e9..c40c9ed 100644
--- a/metropolis/cli/metroctl/cmd_install.go
+++ b/metropolis/cli/metroctl/cmd_install.go
@@ -17,6 +17,7 @@
 
 	"source.monogon.dev/metropolis/cli/flagdefs"
 	"source.monogon.dev/metropolis/cli/metroctl/core"
+	common "source.monogon.dev/metropolis/node"
 	"source.monogon.dev/osbase/blkio"
 	"source.monogon.dev/osbase/fat32"
 )
@@ -44,6 +45,13 @@
 
 	var params *api.NodeParameters
 	if *bootstrap {
+		if flags.cluster == "" {
+			return nil, fmt.Errorf("when bootstrapping a cluster, the --cluster parameter is required")
+		}
+		if err := common.ValidateClusterDomain(flags.cluster); err != nil {
+			return nil, fmt.Errorf("invalid cluster domain: %w", err)
+		}
+
 		// TODO(lorenz): Have a key management story for this
 		priv, err := core.GetOrMakeOwnerKey(flags.configPath)
 		if err != nil {
@@ -55,6 +63,7 @@
 				ClusterBootstrap: &api.NodeParameters_ClusterBootstrap{
 					OwnerPublicKey: pub,
 					InitialClusterConfiguration: &cpb.ClusterConfiguration{
+						ClusterDomain:         flags.cluster,
 						StorageSecurityPolicy: *bootstrapStorageSecurityPolicy,
 						TpmMode:               *bootstrapTPMMode,
 					},
diff --git a/metropolis/cli/metroctl/main.go b/metropolis/cli/metroctl/main.go
index 21f87a6..6d26d4c 100644
--- a/metropolis/cli/metroctl/main.go
+++ b/metropolis/cli/metroctl/main.go
@@ -22,6 +22,8 @@
 }
 
 type metroctlFlags struct {
+	// cluster is the domain name identifying the target cluster.
+	cluster string
 	// clusterEndpoints is a list of the targeted cluster's endpoints, used by
 	// commands that perform RPC on it.
 	clusterEndpoints []string
@@ -53,6 +55,7 @@
 var flags metroctlFlags
 
 func init() {
+	rootCmd.PersistentFlags().StringVar(&flags.cluster, "cluster", "", "Cluster domain")
 	rootCmd.PersistentFlags().StringSliceVar(&flags.clusterEndpoints, "endpoints", nil, "A list of the target cluster's endpoints.")
 	rootCmd.PersistentFlags().StringVar(&flags.proxyAddr, "proxy", "", "SOCKS5 proxy address")
 	rootCmd.PersistentFlags().StringVar(&flags.configPath, "config", filepath.Join(xdg.ConfigHome, "metroctl"), "An alternative cluster config path")