diff --git a/go/base/context.go b/go/base/context.go
index 2d9eaf7..bb360d0 100644
--- a/go/base/context.go
+++ b/go/base/context.go
@@ -84,11 +84,13 @@ type MigrationContext struct {
 	IsTungsten               bool
 	DiscardForeignKeys       bool
 
-	config      ContextConfig
-	configMutex *sync.Mutex
-	ConfigFile  string
-	CliUser     string
-	CliPassword string
+	config            ContextConfig
+	configMutex       *sync.Mutex
+	ConfigFile        string
+	CliUser           string
+	CliPassword       string
+	CliMasterUser     string
+	CliMasterPassword string
 
 	HeartbeatIntervalMilliseconds       int64
 	defaultNumRetries                   int64
diff --git a/go/cmd/gh-ost/main.go b/go/cmd/gh-ost/main.go
index 63bb230..bb8b8d2 100644
--- a/go/cmd/gh-ost/main.go
+++ b/go/cmd/gh-ost/main.go
@@ -50,6 +50,8 @@ func main() {
 	flag.IntVar(&migrationContext.InspectorConnectionConfig.Key.Port, "port", 3306, "MySQL port (preferably a replica, not the master)")
 	flag.StringVar(&migrationContext.CliUser, "user", "", "MySQL user")
 	flag.StringVar(&migrationContext.CliPassword, "password", "", "MySQL password")
+	flag.StringVar(&migrationContext.CliMasterUser, "master-user", "", "MySQL user on master, if different from that on replica. Requires --assume-master-host")
+	flag.StringVar(&migrationContext.CliMasterPassword, "master-password", "", "MySQL password on master, if different from that on replica. Requires --assume-master-host")
 	flag.StringVar(&migrationContext.ConfigFile, "conf", "", "Config file")
 	askPass := flag.Bool("ask-pass", false, "prompt for MySQL password")
 
@@ -170,8 +172,11 @@ func main() {
 		}
 		log.Warning("--test-on-replica-skip-replica-stop enabled. We will not stop replication before cut-over. Ensure you have a plugin that does this.")
 	}
-	if migrationContext.AssumeMasterHostname != "" && !migrationContext.AllowedMasterMaster && !migrationContext.IsTungsten {
-		log.Fatalf("--assume-master-host requires either --allow-master-master or --tungsten")
+	if migrationContext.CliMasterUser != "" && migrationContext.AssumeMasterHostname == "" {
+		log.Fatalf("--master-user requires --assume-master-host")
+	}
+	if migrationContext.CliMasterPassword != "" && migrationContext.AssumeMasterHostname == "" {
+		log.Fatalf("--master-password requires --assume-master-host")
 	}
 
 	switch *cutOver {
diff --git a/go/logic/migrator.go b/go/logic/migrator.go
index 7c55b80..b788d8c 100644
--- a/go/logic/migrator.go
+++ b/go/logic/migrator.go
@@ -681,6 +681,12 @@ func (this *Migrator) initiateInspector() (err error) {
 			return err
 		}
 		this.migrationContext.ApplierConnectionConfig = this.migrationContext.InspectorConnectionConfig.DuplicateCredentials(*key)
+		if this.migrationContext.CliMasterUser != "" {
+			this.migrationContext.ApplierConnectionConfig.User = this.migrationContext.CliMasterUser
+		}
+		if this.migrationContext.CliMasterPassword != "" {
+			this.migrationContext.ApplierConnectionConfig.Password = this.migrationContext.CliMasterPassword
+		}
 		log.Infof("Master forced to be %+v", *this.migrationContext.ApplierConnectionConfig.ImpliedKey)
 	}
 	// validate configs