diff --git a/cmd/crproxy/cluster/agent/agent.go b/cmd/crproxy/cluster/agent/agent.go
index 81cd25a..2600afe 100644
--- a/cmd/crproxy/cluster/agent/agent.go
+++ b/cmd/crproxy/cluster/agent/agent.go
@@ -130,6 +130,7 @@ func runE(ctx context.Context, flags *flagpole) error {
 	}
 
 	transportOpts := []transport.Option{
+		transport.WithUserAndPass(flags.Userpass),
 		transport.WithLogger(logger),
 	}
 
diff --git a/cmd/crproxy/cluster/gateway/gateway.go b/cmd/crproxy/cluster/gateway/gateway.go
index 2cfb285..7942ab7 100644
--- a/cmd/crproxy/cluster/gateway/gateway.go
+++ b/cmd/crproxy/cluster/gateway/gateway.go
@@ -165,6 +165,7 @@ func runE(ctx context.Context, flags *flagpole) error {
 	}
 
 	transportOpts := []transport.Option{
+		transport.WithUserAndPass(flags.Userpass),
 		transport.WithLogger(logger),
 	}
 
diff --git a/transport/transport.go b/transport/transport.go
index 6f47b2e..77a5880 100644
--- a/transport/transport.go
+++ b/transport/transport.go
@@ -56,7 +56,10 @@ func NewTransport(opts ...Option) (http.RoundTripper, error) {
 	}
 
 	for _, opt := range opts {
-		opt(c)
+		err := opt(c)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	return c, nil
@@ -169,7 +172,7 @@ func toUserAndPass(userpass []string) (map[string]authn.AuthConfig, error) {
 		}
 
 		u := strings.SplitN(s[0], ":", 3)
-		if len(s) != 2 {
+		if len(u) != 2 {
 			return nil, fmt.Errorf("invalid userpass %q", up)
 		}
 		host := s[1]