diff --git a/agent/access.go b/agent/access.go
index de7ffcda..8c164b4a 100644
--- a/agent/access.go
+++ b/agent/access.go
@@ -14,6 +14,10 @@ type access struct {
 	frontendToken   string
 	token           string
 	bindAddress     string
+	autoMode        bool
+	autoAddress     string
+	autoStartPort   uint16
+	autoEndPort     uint16
 	responseHeaders []string
 
 	process      *proctree.Child
diff --git a/agent/accessPrivate.go b/agent/accessPrivate.go
index 40b82ffc..2107f2df 100644
--- a/agent/accessPrivate.go
+++ b/agent/accessPrivate.go
@@ -3,6 +3,7 @@ package agent
 import (
 	"context"
 	"errors"
+	"fmt"
 	"github.com/openziti/zrok/agent/agentGrpc"
 	"github.com/openziti/zrok/agent/proctree"
 	"github.com/openziti/zrok/environment"
@@ -21,9 +22,19 @@ func (i *agentGrpcImpl) AccessPrivate(_ context.Context, req *agentGrpc.AccessPr
 	}
 
 	accCmd := []string{os.Args[0], "access", "private", "--subordinate", "-b", req.BindAddress, req.Token}
+	if req.AutoMode {
+		accCmd = append(accCmd, "--auto", "--auto-address", req.AutoAddress, "--auto-start-port", fmt.Sprintf("%v", req.AutoStartPort))
+		accCmd = append(accCmd, "--auto-end-port", fmt.Sprintf("%v", req.AutoEndPort))
+	}
+	logrus.Info(accCmd)
+
 	acc := &access{
 		token:           req.Token,
 		bindAddress:     req.BindAddress,
+		autoMode:        req.AutoMode,
+		autoAddress:     req.AutoAddress,
+		autoStartPort:   uint16(req.AutoStartPort),
+		autoEndPort:     uint16(req.AutoEndPort),
 		responseHeaders: req.ResponseHeaders,
 		bootComplete:    make(chan struct{}),
 		agent:           i.agent,
diff --git a/cmd/zrok/accessPrivate.go b/cmd/zrok/accessPrivate.go
index 75df7403..b2f28fbd 100644
--- a/cmd/zrok/accessPrivate.go
+++ b/cmd/zrok/accessPrivate.go
@@ -374,11 +374,19 @@ func (cmd *accessPrivateCommand) accessAgent(args []string, root env_core.Root)
 	}
 	defer func() { _ = conn.Close() }()
 
-	acc, err := client.AccessPrivate(context.Background(), &agentGrpc.AccessPrivateRequest{
+	req := &agentGrpc.AccessPrivateRequest{
 		Token:           args[0],
 		BindAddress:     cmd.bindAddress,
 		ResponseHeaders: cmd.responseHeaders,
-	})
+	}
+	if cmd.autoMode {
+		req.AutoMode = true
+		req.AutoAddress = cmd.autoAddress
+		req.AutoStartPort = uint32(cmd.autoStartPort)
+		req.AutoEndPort = uint32(cmd.autoEndPort)
+	}
+
+	acc, err := client.AccessPrivate(context.Background(), req)
 	if err != nil {
 		tui.Error("error creating access", err)
 	}