diff --git a/nfpm/zrok-share.bash b/nfpm/zrok-share.bash
index 0b55a663..176582a9 100644
--- a/nfpm/zrok-share.bash
+++ b/nfpm/zrok-share.bash
@@ -92,17 +92,15 @@ else
   if [[ -n "${ZROK_SHARE_OPTS:-}" ]]; then
     ZROK_CMD+=" ${ZROK_SHARE_OPTS}"
   fi
-  if [[ -n "${ZROK_OAUTH_PROVIDER:-}" ]]; then
+  if [[ -n "${ZROK_BASIC_AUTH:-}" ]]; then
+    ZROK_CMD+=" --basic-auth ${ZROK_BASIC_AUTH}"
+  elif [[ -n "${ZROK_OAUTH_PROVIDER:-}" ]]; then
     ZROK_CMD+=" --oauth-provider ${ZROK_OAUTH_PROVIDER}"
-  fi
-  if [[ -n "${ZROK_OAUTH_EMAILS:-}" ]]; then
-    for EMAIL in ${ZROK_OAUTH_EMAILS}; do
-      if ! [[ ${EMAIL} =~ @ ]]; then
-        echo "WARNING: '${EMAIL}' does not contain '@' so it may match more than one email domain!" >&2
-      fi
-      ZROK_CMD+=" --oauth-email-domains ${EMAIL}"
-    done
-  fi
+    if [[ -n "${ZROK_OAUTH_EMAILS:-}" ]]; then
+      for EMAIL in ${ZROK_OAUTH_EMAILS}; do
+        ZROK_CMD+=" --oauth-email-domains ${EMAIL}"
+      done
+    fi
   echo "INFO: running: zrok ${ZROK_CMD}"
   zrok ${ZROK_CMD} | jq -rc | tee ~/.zrok/reserved.json
 fi
diff --git a/nfpm/zrok-share.env b/nfpm/zrok-share.env
index 7b9efca1..2fa9ea32 100644
--- a/nfpm/zrok-share.env
+++ b/nfpm/zrok-share.env
@@ -73,6 +73,11 @@ ZROK_SHARE_OPTS=""
 # WARNING: changing this value requires provisioning a new frontend URL
 #ZROK_OAUTH_EMAILS="bob@acme.example.com alice@forge.example.com @corp.example.com"
 
+# you MAY require a password with HTTP basic authentication
+# WARNING: changing this value requires provisioning a new frontend URL
+# NOTE: basic auth and oauth are mutually exclusive
+#ZROK_BASIC_AUTH=""
+
 # set if self-hosting zrok and not using only the default frontend name 'public'; must be a space-separated list
 # WARNING: changing this value requires provisioning a new frontend URL
 #ZROK_FRONTENDS="public"