diff --git a/internal/cmd/commands/targetscmd/funcs.go b/internal/cmd/commands/targetscmd/funcs.go
index 77cf8791f..8ffa0bb6c 100644
--- a/internal/cmd/commands/targetscmd/funcs.go
+++ b/internal/cmd/commands/targetscmd/funcs.go
@@ -33,6 +33,7 @@ type extraCmdVars struct {
 	flagHostSources                    []string
 	flagApplicationCredentialLibraries []string
 	flagApplicationCredentialSources   []string
+	flagEgressCredentialSources        []string
 	flagHostId                         string
 	sar                                *targets.SessionAuthorizationResult
 }
@@ -49,9 +50,9 @@ func extraActionsFlagsMapFuncImpl() map[string][]string {
 		"add-credential-libraries":    {"id", "application-credential-library", "version"},
 		"remove-credential-libraries": {"id", "application-credential-library", "version"},
 		"set-credential-libraries":    {"id", "application-credential-library", "version"},
-		"add-credential-sources":      {"id", "application-credential-source", "version"},
-		"remove-credential-sources":   {"id", "application-credential-source", "version"},
-		"set-credential-sources":      {"id", "application-credential-source", "version"},
+		"add-credential-sources":      {"id", "application-credential-source", "egress-credential-source", "version"},
+		"remove-credential-sources":   {"id", "application-credential-source", "egress-credential-source", "version"},
+		"set-credential-sources":      {"id", "application-credential-source", "egress-credential-source", "version"},
 	}
 }
 
@@ -361,6 +362,12 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 				Target: &c.flagApplicationCredentialSources,
 				Usage:  "The credential source for application purpose to add, set, or remove.  May be specified multiple times.",
 			})
+		case "egress-credential-source":
+			f.StringSliceVar(&base.StringSliceVar{
+				Name:   "egress-credential-source",
+				Target: &c.flagEgressCredentialSources,
+				Usage:  "The credential source for egress purpose to add, set, or remove.  May be specified multiple times.",
+			})
 		}
 	}
 
@@ -460,7 +467,6 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 		}
 
 	case "add-credential-libraries", "remove-credential-libraries":
-		// TODO: As we add other purposes, add them to this check
 		if len(c.flagApplicationCredentialLibraries) == 0 {
 			c.UI.Error("No credential-libraries supplied via -application-credential-library")
 			return false
@@ -469,14 +475,19 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 
 	case "add-credential-sources", "remove-credential-sources":
 		// TODO: As we add other purposes, add them to this check
-		if len(c.flagApplicationCredentialSources) == 0 {
-			c.UI.Error("No credential sources supplied via -application-credential-source")
+		if len(c.flagApplicationCredentialSources)+len(c.flagEgressCredentialSources) == 0 {
+			c.UI.Error("No credential sources supplied via -application-credential-source or -egress-credential-source")
 			return false
 		}
-		*opts = append(*opts, targets.WithApplicationCredentialSourceIds(c.flagApplicationCredentialSources))
+
+		if len(c.flagApplicationCredentialSources) > 0 {
+			*opts = append(*opts, targets.WithApplicationCredentialSourceIds(c.flagApplicationCredentialSources))
+		}
+		if len(c.flagEgressCredentialSources) > 0 {
+			*opts = append(*opts, targets.WithEgressCredentialSourceIds(c.flagEgressCredentialSources))
+		}
 
 	case "set-credential-libraries":
-		// TODO: As we add other purposes, add them to this check
 		switch len(c.flagApplicationCredentialLibraries) {
 		case 0:
 			c.UI.Error("No credential-libraries supplied via -application-credential-library")
@@ -493,10 +504,14 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 
 	case "set-credential-sources":
 		// TODO: As we add other purposes, add them to this check
+		if len(c.flagApplicationCredentialSources)+len(c.flagEgressCredentialSources) == 0 {
+			c.UI.Error("No credential sources supplied via -application-credential-source or -egress-credential-source")
+			return false
+		}
+
 		switch len(c.flagApplicationCredentialSources) {
 		case 0:
-			c.UI.Error("No credential sources supplied via -application-credential-source")
-			return false
+			// do nothing
 		case 1:
 			if c.flagApplicationCredentialSources[0] == "null" {
 				*opts = append(*opts, targets.DefaultApplicationCredentialSourceIds())
@@ -506,6 +521,18 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 		default:
 			*opts = append(*opts, targets.WithApplicationCredentialSourceIds(c.flagApplicationCredentialSources))
 		}
+		switch len(c.flagEgressCredentialSources) {
+		case 0:
+			// do nothing
+		case 1:
+			if c.flagEgressCredentialSources[0] == "null" {
+				*opts = append(*opts, targets.DefaultEgressCredentialSourceIds())
+				break
+			}
+			fallthrough
+		default:
+			*opts = append(*opts, targets.WithEgressCredentialSourceIds(c.flagEgressCredentialSources))
+		}
 
 	case "authorize-session":
 		if len(c.flagHostId) != 0 {