diff --git a/docs/cli/manage-your-fleet.md b/docs/cli/manage-your-fleet.md
index a78c54ba19..452125e1c7 100644
--- a/docs/cli/manage-your-fleet.md
+++ b/docs/cli/manage-your-fleet.md
@@ -132,6 +132,20 @@ viam machines part tunnel \
   --destination-port=8080
 ```
 
+If the destination port is not already in the machine's tunnel configuration, the CLI adds it automatically.
+
+To tunnel directly without internet access, pass the machine address and API key:
+
+```sh {class="command-line" data-prompt="$"}
+viam machines part tunnel \
+  --part=<part-id> \
+  --local-port=8080 \
+  --destination-port=8080 \
+  --address=my-machine.local:8080 \
+  --key-id=<key-id> \
+  --key=<key-value>
+```
+
 ## Run component and service methods
 
 Call a gRPC method on a component or service directly from the CLI, like `curl` for Viam's API:
diff --git a/docs/cli/reference.md b/docs/cli/reference.md
index 32d5629334..f58e1800ea 100644
--- a/docs/cli/reference.md
+++ b/docs/cli/reference.md
@@ -1282,19 +1282,31 @@ viam machines part cp --part=123 -r -p machine:my_dir machine:my_file ~/some/exi
 
 ### `machines part tunnel`
 
-Tunnel connections to a specified port on a machine part. You must explicitly enumerate ports to which you are allowed to tunnel in your machine's JSON config. See [Tunnel to a machine part](/fleet/system-settings/).
+Tunnel connections from a local port to a destination port on a machine part.
+
+By default, the tunnel resolves the machine and authenticates through app.viam.com.
+To tunnel directly without internet access, provide all three of `--address`, `--key-id`, and `--key`.
+
+If the destination port is not already listed in the machine's `traffic_tunnel_endpoints` configuration, the CLI attempts to add it automatically. See [Configure tunneling](/fleet/system-settings/#configure-networking-settings-for-tunneling).
 
 ```sh {class="command-line" data-prompt="$"}
-# tunnel connections to the specified port on a machine part
-viam machines part tunnel --part=123 --destination-port=1111 --local-port 2222
+# tunnel through app.viam.com (default)
+viam machines part tunnel --part=123 --destination-port=1111 --local-port=2222
+
+# tunnel directly to a machine without internet
+viam machines part tunnel --part=123 --destination-port=1111 --local-port=2222 \
+  --address=my-machine.local:8080 --key-id=<key-id> --key=<key-value>
 ```
 
 <!-- prettier-ignore -->
 | Argument | Description | Required? |
 | -------- | ----------- | --------- |
 | `--part` | Part ID for which the command is being issued. | **Required** |
-| `--destination-port` | The port on a machine part to tunnel to. | **Required** |
+| `--destination-port` | The port on the machine part to tunnel to. | **Required** |
 | `--local-port` | The local port from which to tunnel. | **Required** |
+| `--address` | Machine FQDN to dial directly. Requires `--key-id` and `--key`. | Optional |
+| `--key-id` | ID of the machine API key. Requires `--address` and `--key`. | Optional |
+| `--key` | Value of the machine API key. Requires `--address` and `--key-id`. | Optional |
 
 ### `machines part get-ftdc`
 
diff --git a/docs/fleet/system-settings.md b/docs/fleet/system-settings.md
index 22e134ef1a..ea4dbed64c 100644
--- a/docs/fleet/system-settings.md
+++ b/docs/fleet/system-settings.md
@@ -56,7 +56,10 @@ In the machine settings card, open **Settings** and expand **Known Networks**. C
 
 ## Configure tunneling {#configure-networking-settings-for-tunneling}
 
-Allow secure port forwarding from a local machine to a remote machine through Viam's cloud connection. You must list allowed ports in the machine configuration.
+Allow secure port forwarding from a local machine to a remote machine through Viam's cloud connection.
+
+If you run `viam machines part tunnel` and the destination port is not already configured, the CLI attempts to add it to the machine config automatically.
+You can also list allowed ports manually in the machine configuration:
 
 ```json
 {
@@ -82,6 +85,13 @@ To connect through the tunnel, use the CLI:
 viam machines part tunnel --part=<part-id> --local-port=8080 --destination-port=8080
 ```
 
+To tunnel directly to a machine without internet access, pass the machine address and API key credentials:
+
+```sh {class="command-line" data-prompt="$"}
+viam machines part tunnel --part=<part-id> --local-port=8080 --destination-port=8080 \
+  --address=my-machine.local:8080 --key-id=<key-id> --key=<key-value>
+```
+
 ## Disable TLS
 
 By default, `viam-server` uses TLS for all connections. To disable TLS (for development or isolated networks only):