diff --git a/CITATION.cff b/CITATION.cff
index 973d32f..0e7c9db 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -24,5 +24,5 @@ keywords:
   - management
   - integration
 license: Apache-2.0
-version: 26.09.2
-date-released: "2026-09-14"
+version: 26.9.3
+date-released: "2026-09-15"
diff --git a/engines/mongodb.py b/engines/mongodb.py
index 83c5c0b..31a0c02 100644
--- a/engines/mongodb.py
+++ b/engines/mongodb.py
@@ -43,6 +43,38 @@ def fields_existing(self) -> list[Field]:
         }
         return [overrides.get(field.name, field) for field in super().fields_existing()]
 
+    def option_fields(self) -> list[Field]:
+        return [
+            Field(
+                "auth_source",
+                "Auth source",
+                "text",
+                default="",
+                help=(
+                    "Authentication database, set as authSource on the URI. Leave "
+                    "empty to use admin when credentials are provided. Override if "
+                    "your user is defined in another database."
+                ),
+            ),
+            Field(
+                "replica_set",
+                "Replica set",
+                "text",
+                default="",
+                help=(
+                    "Replica set name, set as replicaSet on the URI. Required to "
+                    "connect to a self-hosted replica set."
+                ),
+            ),
+            Field(
+                "tls",
+                "Force TLS?",
+                "bool",
+                default=False,
+                help="When enabled, adds tls=true to the URI to force a TLS connection.",
+            ),
+        ]
+
     def generate(
         self, *, auth: bool, ports: PortAllocator, answers: dict[str, Any]
     ) -> DatabaseSpec:
@@ -58,6 +90,7 @@ def generate(
             database=db_name,
             username="admin" if auth else "",
             password=generate_password(16) if auth else None,
+            options=dict(answers.get("options", {})),
         )
 
     def env_vars(self, spec: DatabaseSpec) -> dict[str, str]:
diff --git a/pyproject.toml b/pyproject.toml
index d0fea3d..129faf4 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "portabase-cli"
-version = "26.09.2"
+version = "26.9.3"
 description = "The official command line interface (CLI) for managing and deploying Portabase instances with ease."
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/tests/engines/mongodb.py b/tests/engines/mongodb.py
index 36c1061..891cf06 100644
--- a/tests/engines/mongodb.py
+++ b/tests/engines/mongodb.py
@@ -80,7 +80,11 @@ def fields():
         ("password", "secret", ""),
     ]
     assert MONGO.fields_new() == []
-    assert MONGO.option_fields() == []
+    assert field_specs(MONGO.option_fields()) == [
+        ("auth_source", "text", ""),
+        ("replica_set", "text", ""),
+        ("tls", "bool", False),
+    ]
 
 
 def from_existing():
@@ -133,6 +137,25 @@ def compose_service_inline(render_engine):
     ]
 
 
+def generate_keeps_options(ports):
+    options = {"replica_set": "rs0", "tls": True}
+    spec = MONGO.generate(auth=True, ports=ports, answers={"options": options})
+    assert spec.options == options
+
+
+def only_non_default_options_reach_the_agent(ports):
+    options = {"auth_source": "", "replica_set": "rs0", "tls": False, "unknown": 1}
+    spec = MONGO.generate(auth=True, ports=ports, answers={"options": options})
+    assert MONGO.non_default_options(spec) == {"replica_set": "rs0"}
+    assert MONGO.agent_entry(spec)["options"] == {"replica_set": "rs0"}
+    tls_only = spec.with_options({"tls": True})
+    assert MONGO.agent_entry(tls_only)["options"] == {"tls": True}
+    custom_auth = spec.with_options({"auth_source": "users"})
+    assert MONGO.agent_entry(custom_auth)["options"] == {"auth_source": "users"}
+    defaults = spec.with_options({"auth_source": "", "replica_set": "", "tls": False})
+    assert "options" not in MONGO.agent_entry(defaults)
+
+
 def port_field_mentions_srv():
     port = next(field for field in MONGO.fields_existing() if field.name == "port")
     assert "mongodb+srv://" in (port.help or "")
diff --git a/uv.lock b/uv.lock
index de95f97..69cc7c8 100644
--- a/uv.lock
+++ b/uv.lock
@@ -521,7 +521,7 @@ wheels = [
 
 [[package]]
 name = "portabase-cli"
-version = "26.9.2"
+version = "26.9.3"
 source = { virtual = "." }
 dependencies = [
     { name = "jinja2" },