diff --git a/docs/balena-cli.md b/docs/balena-cli.md
index 0ea7eef0..9d60a92b 100644
--- a/docs/balena-cli.md
+++ b/docs/balena-cli.md
@@ -811,6 +811,10 @@ path to the config JSON file, see `balena os build-config`
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## device local-mode <uuid>
 
 Output current local mode status, or enable/disable local mode
@@ -2236,6 +2240,10 @@ paths to local files to place into the 'system-connections' directory
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## os initialize <image>
 
 Initialize an os image for a device with a previously
@@ -2373,6 +2381,10 @@ supervisor cloud polling interval in minutes (e.g. for device variables)
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## config inject <file>
 
 Inject a 'config.json' file to a balenaOS image file or attached SD card or
diff --git a/lib/commands/config/generate.ts b/lib/commands/config/generate.ts
index 94bc6c9a..244ac07d 100644
--- a/lib/commands/config/generate.ts
+++ b/lib/commands/config/generate.ts
@@ -37,6 +37,7 @@ interface FlagsDef {
 	wifiKey?: string;
 	appUpdatePollInterval?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 	help: void;
 }
 
@@ -81,7 +82,11 @@ export default class ConfigGenerateCmd extends Command {
 		dev: cf.dev,
 		device: {
 			...cf.device,
-			exclusive: ['fleet', 'provisioning-key-name'],
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
 		},
 		deviceApiKey: flags.string({
 			description:
@@ -120,6 +125,11 @@ export default class ConfigGenerateCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['device'],
+		}),
 		help: cf.help,
 	};
 
@@ -196,6 +206,7 @@ export default class ConfigGenerateCmd extends Command {
 		answers.version = options.version;
 		answers.developmentMode = options.dev;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		// Generate config
 		const { generateDeviceConfig, generateApplicationConfig } = await import(
diff --git a/lib/commands/device/init.ts b/lib/commands/device/init.ts
index 0ad5bc22..024a76e8 100644
--- a/lib/commands/device/init.ts
+++ b/lib/commands/device/init.ts
@@ -31,6 +31,7 @@ interface FlagsDef {
 	config?: string;
 	help: void;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 export default class DeviceInitCmd extends Command {
@@ -97,6 +98,10 @@ export default class DeviceInitCmd extends Command {
 		'provisioning-key-name': flags.string({
 			description: 'custom key name assigned to generated provisioning api key',
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+		}),
 		help: cf.help,
 	};
 
@@ -185,6 +190,14 @@ export default class DeviceInitCmd extends Command {
 				options['provisioning-key-name'],
 			);
 		}
+
+		if (options['provisioning-key-expiry-date']) {
+			configureCommand.push(
+				'--provisioning-key-expiry-date',
+				options['provisioning-key-expiry-date'],
+			);
+		}
+
 		await runCommand(configureCommand);
 	}
 
diff --git a/lib/commands/os/configure.ts b/lib/commands/os/configure.ts
index 294406b1..c0a00fc6 100644
--- a/lib/commands/os/configure.ts
+++ b/lib/commands/os/configure.ts
@@ -43,6 +43,7 @@ interface FlagsDef {
 	'system-connection': string[];
 	'initial-device-name'?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 interface ArgsDef {
@@ -58,6 +59,7 @@ interface Answers {
 	wifiSsid?: string;
 	wifiKey?: string;
 	provisioningKeyName?: string;
+	provisioningKeyExpiryDate?: string;
 }
 
 export default class OsConfigureCmd extends Command {
@@ -121,7 +123,7 @@ export default class OsConfigureCmd extends Command {
 		config: flags.string({
 			description:
 				'path to a pre-generated config.json file to be injected in the OS image',
-			exclusive: ['provisioning-key-name'],
+			exclusive: ['provisioning-key-name', 'provisioning-key-expiry-date'],
 		}),
 		'config-app-update-poll-interval': flags.integer({
 			description:
@@ -138,7 +140,14 @@ export default class OsConfigureCmd extends Command {
 			description: 'WiFi SSID (network name) (non-interactive configuration)',
 		}),
 		dev: cf.dev,
-		device: { ...cf.device, exclusive: ['fleet', 'provisioning-key-name'] },
+		device: {
+			...cf.device,
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
+		},
 		'device-type': flags.string({
 			description:
 				'device type slug (e.g. "raspberrypi3") to override the fleet device type',
@@ -161,6 +170,11 @@ export default class OsConfigureCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['config', 'device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['config', 'device'],
+		}),
 		help: cf.help,
 	};
 
@@ -235,6 +249,7 @@ export default class OsConfigureCmd extends Command {
 		answers.version = osVersion;
 		answers.developmentMode = options.dev;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		if (_.isEmpty(configJson)) {
 			if (device) {
diff --git a/tests/commands/os/configure.spec.ts b/tests/commands/os/configure.spec.ts
index 14cf4606..72688fee 100644
--- a/tests/commands/os/configure.spec.ts
+++ b/tests/commands/os/configure.spec.ts
@@ -59,6 +59,7 @@ if (process.platform !== 'win32') {
 				'--config-network ethernet',
 				'--initial-device-name testDeviceName',
 				'--provisioning-key-name testKey',
+				'--provisioning-key-expiry-date 2050-12-12',
 			];
 
 			const { err } = await runCommand(command.join(' '));