diff --git a/mitmproxy/options.py b/mitmproxy/options.py
index 26b7030e7..8e8857358 100644
--- a/mitmproxy/options.py
+++ b/mitmproxy/options.py
@@ -23,6 +23,7 @@ DEFAULT_CLIENT_CIPHERS = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA
 class Options(optmanager.OptManager):
     def __init__(
             self,
+            *,  # all args are keyword-only.
             # TODO: rename to onboarding_app_*
             app: bool = True,
             app_host: str = APP_HOST,
diff --git a/mitmproxy/tools/console/master.py b/mitmproxy/tools/console/master.py
index 909c83da6..929592569 100644
--- a/mitmproxy/tools/console/master.py
+++ b/mitmproxy/tools/console/master.py
@@ -203,6 +203,7 @@ class ConsoleState(state.State):
 class Options(mitmproxy.options.Options):
     def __init__(
             self,
+            *,  # all args are keyword-only.
             eventlog: bool = False,
             follow: bool = False,
             intercept: bool = False,
diff --git a/mitmproxy/tools/dump.py b/mitmproxy/tools/dump.py
index e92482f39..72895102c 100644
--- a/mitmproxy/tools/dump.py
+++ b/mitmproxy/tools/dump.py
@@ -18,6 +18,7 @@ class DumpError(Exception):
 class Options(options.Options):
     def __init__(
             self,
+            *, # all args are keyword-only.
             keepserving: bool = False,
             filtstr: Optional[str] = None,
             flow_detail: int = 1,
diff --git a/mitmproxy/tools/web/master.py b/mitmproxy/tools/web/master.py
index 619582f34..9cf17faff 100644
--- a/mitmproxy/tools/web/master.py
+++ b/mitmproxy/tools/web/master.py
@@ -94,6 +94,7 @@ class WebState(state.State):
 class Options(options.Options):
     def __init__(
             self,
+            *,  # all args are keyword-only.
             intercept: Optional[str] = None,
             wdebug: bool = bool,
             wport: int = 8081,