diff --git a/cmd/pebble-challtestsrv/main.go b/cmd/pebble-challtestsrv/main.go
index 3b3d7334..222af1f2 100644
--- a/cmd/pebble-challtestsrv/main.go
+++ b/cmd/pebble-challtestsrv/main.go
@@ -6,12 +6,14 @@ package main
 import (
 	"context"
 	"flag"
+	"fmt"
 	"log"
 	"net/http"
 	"os"
 	"strings"
 
 	"github.com/letsencrypt/challtestsrv"
+
 	"github.com/letsencrypt/pebble/v2/cmd"
 )
 
@@ -75,6 +77,12 @@ func main() {
 
 	flag.Parse()
 
+	if len(flag.Args()) > 0 {
+		fmt.Printf("invalid command line arguments: %s\n", strings.Join(flag.Args(), " "))
+		flag.Usage()
+		os.Exit(1)
+	}
+
 	httpOneAddresses := filterEmpty(strings.Split(*httpOneBind, ","))
 	httpsOneAddresses := filterEmpty(strings.Split(*httpsOneBind, ","))
 	dohAddresses := filterEmpty(strings.Split(*dohBind, ","))
diff --git a/cmd/pebble/main.go b/cmd/pebble/main.go
index fde0ed5d..3083659b 100644
--- a/cmd/pebble/main.go
+++ b/cmd/pebble/main.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"strconv"
+	"strings"
 
 	"github.com/letsencrypt/pebble/v2/ca"
 	"github.com/letsencrypt/pebble/v2/cmd"
@@ -59,6 +60,12 @@ func main() {
 		"Print the software version")
 	flag.Parse()
 
+	if len(flag.Args()) > 0 {
+		fmt.Printf("invalid command line arguments: %s\n", strings.Join(flag.Args(), " "))
+		flag.Usage()
+		os.Exit(1)
+	}
+
 	if *versionFlag {
 		// Print the version and exit
 		fmt.Printf("Pebble version: %s\n", version)