diff --git a/proxy/src/bin/pg_sni_router.rs b/proxy/src/bin/pg_sni_router.rs
index adaf065e1b..62cf734373 100644
--- a/proxy/src/bin/pg_sni_router.rs
+++ b/proxy/src/bin/pg_sni_router.rs
@@ -1,3 +1,8 @@
+/// A stand-alone program that routes connections, e.g. from
+/// `aaa--bbb--123.external.domain` to `aaa.bbb.123.internal.domain`.
+///
+/// This allows connecting to pods/services running in the same Kubernetes cluster from
+/// the outside. Similar to an ingress controller for HTTPS.
 use std::{net::SocketAddr, sync::Arc};
 use tokio::{net::TcpListener, io::AsyncWriteExt};
 
@@ -15,7 +20,6 @@ project_git_version!(GIT_VERSION);
 
 fn cli() -> clap::Command {
     clap::Command::new("Neon proxy/router")
-        .disable_help_flag(true)
         .version(GIT_VERSION)
         .arg(
             Arg::new("listen")
@@ -28,19 +32,22 @@ fn cli() -> clap::Command {
             Arg::new("tls-key")
                 .short('k')
                 .long("tls-key")
-                .help("path to TLS key for client postgres connections"),
+                .help("path to TLS key for client postgres connections")
+                .required(true),
         )
         .arg(
             Arg::new("tls-cert")
                 .short('c')
                 .long("tls-cert")
-                .help("path to TLS cert for client postgres connections"),
+                .help("path to TLS cert for client postgres connections")
+                .required(true),
         )
         .arg(
             Arg::new("dest")
                 .short('d')
                 .long("destination")
-                .help("append this domain zone to the SNI hostname to get the destination address"),
+                .help("append this domain zone to the SNI hostname to get the destination address")
+                .required(true),
         )
 }
 
diff --git a/proxy/src/bin/proxy.rs b/proxy/src/bin/proxy.rs
index 4c66845db6..9b5e8916fe 100644
--- a/proxy/src/bin/proxy.rs
+++ b/proxy/src/bin/proxy.rs
@@ -7,7 +7,7 @@ use anyhow::bail;
 use clap::{self, Arg};
 use proxy::config::{self, ProxyConfig};
 use std::{borrow::Cow, net::SocketAddr};
-use tokio::{net::TcpListener};
+use tokio::net::TcpListener;
 use tokio_util::sync::CancellationToken;
 use tracing::info;
 use utils::{project_git_version, sentry_init::init_sentry};