diff --git a/metropolis/cli/metroctl/approve.go b/metropolis/cli/metroctl/approve.go
index 4a99e9d..adb7b8f 100644
--- a/metropolis/cli/metroctl/approve.go
+++ b/metropolis/cli/metroctl/approve.go
@@ -68,7 +68,7 @@
 		log.Fatal("Please provide at least one cluster endpoint using the --endpoint parameter.")
 	}
 	ctx := clicontext.WithInterrupt(context.Background())
-	cc, err := dialCluster(ctx, opkey, ocert, "", flags.clusterEndpoints)
+	cc, err := dialCluster(ctx, opkey, ocert, flags.proxyAddr, flags.clusterEndpoints)
 	if err != nil {
 		log.Fatalf("While dialing the cluster: %v", err)
 	}
diff --git a/metropolis/cli/metroctl/install.go b/metropolis/cli/metroctl/install.go
index a3657ae..cbbb9b6 100644
--- a/metropolis/cli/metroctl/install.go
+++ b/metropolis/cli/metroctl/install.go
@@ -129,7 +129,7 @@
 		if len(flags.clusterEndpoints) == 0 {
 			log.Fatal("At least one cluster endpoint is required while generating non-bootstrap installer images.")
 		}
-		cc, err := dialCluster(ctx, opkey, ocert, "", flags.clusterEndpoints)
+		cc, err := dialCluster(ctx, opkey, ocert, flags.proxyAddr, flags.clusterEndpoints)
 		if err != nil {
 			log.Fatalf("While dialing the cluster: %v", err)
 		}
diff --git a/metropolis/cli/metroctl/main.go b/metropolis/cli/metroctl/main.go
index d575c5b..9224598 100644
--- a/metropolis/cli/metroctl/main.go
+++ b/metropolis/cli/metroctl/main.go
@@ -14,12 +14,15 @@
 	// clusterEndpoints is a list of the targeted cluster's endpoints, used by
 	// commands that perform RPC on it.
 	clusterEndpoints []string
+	// proxyAddr is a SOCKS5 proxy address the cluster will be accessed through.
+	proxyAddr string
 }
 
 var flags metroctlFlags
 
 func init() {
 	rootCmd.PersistentFlags().StringArrayVar(&flags.clusterEndpoints, "endpoints", nil, "A list of the target cluster's endpoints.")
+	rootCmd.PersistentFlags().StringVar(&flags.proxyAddr, "proxy", "", "SOCKS5 proxy address")
 }
 
 func main() {