diff --git a/control/controlclient/client.go b/control/controlclient/client.go
index 3263d1487..e6fe72eec 100644
--- a/control/controlclient/client.go
+++ b/control/controlclient/client.go
@@ -20,6 +20,7 @@ type LoginFlags int
 const (
 	LoginDefault     = LoginFlags(0)
 	LoginInteractive = LoginFlags(1 << iota) // force user login and key refresh
+	LoginEphemeral                           // set RegisterRequest.Ephemeral
 )
 
 // Client represents a client connection to the control server.
diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index f8981390b..9351dcce5 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -368,6 +368,7 @@ func (c *Direct) doLogin(ctx context.Context, opt loginOpt) (mustRegen bool, new
 		Hostinfo:   hostinfo,
 		Followup:   opt.URL,
 		Timestamp:  &now,
+		Ephemeral:  (opt.Flags & LoginEphemeral) != 0,
 	}
 	if opt.Logout {
 		request.Expiry = time.Unix(123, 0) // far in the past