diff --git a/site/content/docs/reference/cli.md b/site/content/docs/reference/cli.md
index cd155c1a..55a95f01 100644
--- a/site/content/docs/reference/cli.md
+++ b/site/content/docs/reference/cli.md
@@ -189,8 +189,9 @@ pinniped get kubeconfig [flags]
       --static-token string                      Instead of doing an OIDC-based login, specify a static token
       --static-token-env string                  Instead of doing an OIDC-based login, read a static token from the environment
       --timeout duration                         Timeout for autodiscovery and validation (default 10m0s)
+      --upstream-identity-provider-flow string   The type of client flow to use with the upstream identity provider during login with a Supervisor (e.g. 'cli_password', 'browser_authcode')
       --upstream-identity-provider-name string   The name of the upstream identity provider used during login with a Supervisor
-      --upstream-identity-provider-type string   The type of the upstream identity provider used during login with a Supervisor (e.g. 'oidc', 'ldap')
+      --upstream-identity-provider-type string   The type of the upstream identity provider used during login with a Supervisor (e.g. 'oidc', 'ldap', 'activedirectory')
 ```
 
 ### SEE ALSO