diff --git a/src/content/docs/reference/cli/index.mdx b/src/content/docs/reference/cli/index.mdx
index 6cc6a1d5b..2e02f4b7d 100644
--- a/src/content/docs/reference/cli/index.mdx
+++ b/src/content/docs/reference/cli/index.mdx
@@ -270,8 +270,22 @@ oz agent run-cloud \
 * `--host <WORKER_ID>` — run on a specific self-hosted worker instead of Warp-hosted infrastructure.
 * `--attach <PATH>` — attach an image file to the agent query. Can be repeated (maximum 5).
 * `--computer-use` / `--no-computer-use` — enable or disable [Computer Use](/agent-platform/capabilities/computer-use/) for this run.
+* `--harness <HARNESS>` — choose the execution harness for the run. Defaults to `oz` (Warp Agent). Set `claude` or `codex` to run [Claude Code or Codex as a cloud agent](/platform/harnesses/).
+* `--claude-auth-secret <NAME>` — name of the [Warp-managed secret](/platform/secrets/) that authenticates the Claude Code harness. Only valid with `--harness claude`. See [Third-party cloud agent authentication](/platform/harnesses/authentication/).
+* `--codex-auth-secret <NAME>` — name of the [Warp-managed secret](/platform/secrets/) that authenticates the Codex harness. Only valid with `--harness codex`. See [Third-party cloud agent authentication](/platform/harnesses/authentication/).
 * `--file <PATH>` (`-f`) — load run configuration from a YAML or JSON file.
 
+To run a third-party harness, first store the provider credential as a Warp-managed secret, then pass it with the matching flag:
+
+```sh
+# Run Claude Code as a cloud agent, authenticating with a stored Anthropic secret
+oz agent run-cloud \
+  --environment <ENVIRONMENT_ID> \
+  --harness claude \
+  --claude-auth-secret ANTHROPIC_API_KEY \
+  --prompt "Review the latest PR and suggest fixes"
+```
+
 **Key differences from `run`**
 
 * No `--cwd` — the environment determines the working directory.