diff --git a/metropolis/cli/metroctl/takeownership.go b/metropolis/cli/metroctl/takeownership.go
index d6d9df6..b399d17 100644
--- a/metropolis/cli/metroctl/takeownership.go
+++ b/metropolis/cli/metroctl/takeownership.go
@@ -24,17 +24,22 @@
 )
 
 var takeownershipCommand = &cobra.Command{
-	Use:   "takeownership <node-addr>",
+	Use:   "takeownership",
 	Short: "Takes ownership of a new Metropolis cluster",
 	Long: `This takes ownership of a new Metropolis cluster by asking the new
 cluster to issue an owner certificate to for the owner key generated by a
-previous invocation of metroctl install on this machine.`,
-	Example: "takeownership 192.0.2.1",
-	Args:    cobra.ExactArgs(1), // One positional argument: the node address
-	Run:     doTakeOwnership,
+previous invocation of metroctl install on this machine. A single cluster
+endpoint must be provided with the --endpoints parameter.`,
+	Args: cobra.ExactArgs(0),
+	Run:  doTakeOwnership,
 }
 
-func doTakeOwnership(cmd *cobra.Command, args []string) {
+func doTakeOwnership(cmd *cobra.Command, _ []string) {
+	if len(flags.clusterEndpoints) != 1 {
+		log.Fatalf("takeownership requires a single cluster endpoint to be provided with the --endpoints parameter.")
+	}
+	clusterEp := flags.clusterEndpoints[0]
+
 	ctx := clicontext.WithInterrupt(context.Background())
 	ownerPrivateKeyPEM, err := os.ReadFile(filepath.Join(xdg.ConfigHome, "metroctl/owner-key.pem"))
 	if os.IsNotExist(err) {
@@ -58,7 +63,7 @@
 	if err != nil {
 		log.Fatalf("Failed to create ephemeral credentials: %v", err)
 	}
-	client, err := grpc.Dial(net.JoinHostPort(args[0], node.CuratorServicePort.PortString()), grpc.WithTransportCredentials(ephCreds))
+	client, err := grpc.Dial(net.JoinHostPort(clusterEp, node.CuratorServicePort.PortString()), grpc.WithTransportCredentials(ephCreds))
 	if err != nil {
 		log.Fatalf("Failed to create client to given node address: %v", err)
 	}
@@ -112,7 +117,7 @@
 		// MVP: This is insecure, but making this work would be wasted effort
 		// as all of it will be replaced by the identity system.
 		InsecureSkipTLSVerify: true,
-		Server:                "https://" + net.JoinHostPort(args[0], node.KubernetesAPIWrappedPort.PortString()),
+		Server:                "https://" + net.JoinHostPort(clusterEp, node.KubernetesAPIWrappedPort.PortString()),
 	}
 
 	config.Contexts["metropolis"] = &clientapi.Context{