diff --git a/web3_proxy/src/bin/web3_proxy_cli/change_user_tier_by_key.rs b/web3_proxy/src/bin/web3_proxy_cli/change_user_tier_by_key.rs
index 7ae3c2fa..eb5bba9e 100644
--- a/web3_proxy/src/bin/web3_proxy_cli/change_user_tier_by_key.rs
+++ b/web3_proxy/src/bin/web3_proxy_cli/change_user_tier_by_key.rs
@@ -9,20 +9,21 @@ use uuid::Uuid;
 use web3_proxy::frontend::authorization::RpcSecretKey;
 
 /// change a user's tier.
-/// TODO: we probably shouldn't be exposing the RpcSecretKeys at all. Better to take a user/key id
 #[derive(FromArgs, PartialEq, Eq, Debug)]
 #[argh(subcommand, name = "change_user_tier_by_key")]
 pub struct ChangeUserTierByKeyCommand {
-    #[argh(option)]
+    #[argh(positional)]
     /// the RPC key owned by the user you want to change.
     rpc_secret_key: RpcSecretKey,
 
     /// the title of the desired user tier.
-    #[argh(option)]
+    #[argh(positional)]
     user_tier_title: String,
 }
 
 impl ChangeUserTierByKeyCommand {
+    // TODO: don't expose the RpcSecretKeys at all. Better to take a user/key id. this is definitely most convenient
+
     pub async fn main(self, db_conn: &DatabaseConnection) -> anyhow::Result<()> {
         let rpc_secret_key: Uuid = self.rpc_secret_key.into();