diff --git a/config.json b/config.json
new file mode 100644
index 0000000..fac9795
--- /dev/null
+++ b/config.json
@@ -0,0 +1,4 @@
+{
+  "endpoint": "http://you.fosrl.io",
+  "provisioningKey": "spk-xt1opb0fkoqb7qb.hi44jciamqcrdaja4lvz3kp52pl3lssamp6asuyx"
+}
\ No newline at end of file
diff --git a/config.json.bak b/config.json.bak
new file mode 100644
index 0000000..fac9795
--- /dev/null
+++ b/config.json.bak
@@ -0,0 +1,4 @@
+{
+  "endpoint": "http://you.fosrl.io",
+  "provisioningKey": "spk-xt1opb0fkoqb7qb.hi44jciamqcrdaja4lvz3kp52pl3lssamp6asuyx"
+}
\ No newline at end of file
diff --git a/main.go b/main.go
index 94b3b48..0af8773 100644
--- a/main.go
+++ b/main.go
@@ -162,6 +162,9 @@ var (
 
 	// Provisioning key – exchanged once for a permanent newt ID + secret
 	provisioningKey string
+
+	// Path to config file (overrides CONFIG_FILE env var and default location)
+	configFile string
 )
 
 func main() {
@@ -268,6 +271,7 @@ func runNewtMain(ctx context.Context) {
 	noCloudEnv := os.Getenv("NO_CLOUD")
 	noCloud = noCloudEnv == "true"
 	provisioningKey = os.Getenv("NEWT_PROVISIONING_KEY")
+	configFile = os.Getenv("CONFIG_FILE")
 
 	if endpoint == "" {
 		flag.StringVar(&endpoint, "endpoint", "", "Endpoint of your pangolin server")
@@ -319,6 +323,9 @@ func runNewtMain(ctx context.Context) {
 	if provisioningKey == "" {
 		flag.StringVar(&provisioningKey, "provisioning-key", "", "One-time provisioning key used to obtain a newt ID and secret from the server")
 	}
+	if configFile == "" {
+		flag.StringVar(&configFile, "config-file", "", "Path to config file (overrides CONFIG_FILE env var and default location)")
+	}
 
 	// Add new mTLS flags
 	if tlsClientCert == "" {
@@ -593,6 +600,7 @@ func runNewtMain(ctx context.Context) {
 		endpoint,
 		30*time.Second,
 		opt,
+		websocket.WithConfigFile(configFile),
 	)
 	if err != nil {
 		logger.Fatal("Failed to create client: %v", err)
diff --git a/websocket/client.go b/websocket/client.go
index e645a6f..49cf414 100644
--- a/websocket/client.go
+++ b/websocket/client.go
@@ -42,6 +42,7 @@ type Client struct {
 	onTokenUpdate     func(token string)
 	writeMux          sync.Mutex
 	clientType        string // Type of client (e.g., "newt", "olm")
+	configFilePath    string // Optional override for the config file path
 	tlsConfig         TLSConfig
 	metricsCtxMu      sync.RWMutex
 	metricsCtx        context.Context
@@ -77,6 +78,12 @@ func WithBaseURL(url string) ClientOption {
 }
 
 // WithTLSConfig sets the TLS configuration for the client
+func WithConfigFile(path string) ClientOption {
+	return func(c *Client) {
+		c.configFilePath = path
+	}
+}
+
 func WithTLSConfig(config TLSConfig) ClientOption {
 	return func(c *Client) {
 		c.tlsConfig = config
diff --git a/websocket/config.go b/websocket/config.go
index 8ae7ff5..4fb6513 100644
--- a/websocket/config.go
+++ b/websocket/config.go
@@ -19,7 +19,10 @@ import (
 	"github.com/fosrl/newt/logger"
 )
 
-func getConfigPath(clientType string) string {
+func getConfigPath(clientType string, overridePath string) string {
+	if overridePath != "" {
+		return overridePath
+	}
 	configFile := os.Getenv("CONFIG_FILE")
 	if configFile == "" {
 		var configDir string
@@ -45,7 +48,7 @@ func getConfigPath(clientType string) string {
 
 func (c *Client) loadConfig() error {
 	originalConfig := *c.config // Store original config to detect changes
-	configPath := getConfigPath(c.clientType)
+	configPath := getConfigPath(c.clientType, c.configFilePath)
 
 	if c.config.ID != "" && c.config.Secret != "" && c.config.Endpoint != "" {
 		logger.Debug("Config already provided, skipping loading from file")
@@ -118,7 +121,7 @@ func (c *Client) saveConfig() error {
 		return nil
 	}
 
-	configPath := getConfigPath(c.clientType)
+	configPath := getConfigPath(c.clientType, c.configFilePath)
 	data, err := json.MarshalIndent(c.config, "", "  ")
 	if err != nil {
 		return err