diff --git a/src/auth/types.rs b/src/auth/types.rs
index a2e86eb..142811d 100644
--- a/src/auth/types.rs
+++ b/src/auth/types.rs
@@ -61,7 +61,9 @@ pub fn read_only_scopes() -> Vec<&'static str> {
         "code_coverage_read",
         "test_optimization_read",
         "dashboards_read",
+        "built_in_features",
         "data_scanner_read",
+        "dbm_read",
         "error_tracking_read",
         "events_read",
         "gcp_configuration_read",
@@ -146,6 +148,12 @@ pub fn default_scopes() -> Vec<&'static str> {
         "data_scanner_read",
         // Data Streams
         "data_streams_monitoring_capture_messages",
+        // Database Monitoring
+        // built_in_features is required on US1/EU1 while the DBM team migrates to dbm_read.
+        // Both are requested so the command works on all sites during the transition.
+        // Once the migration is complete, built_in_features can be removed from both scope lists.
+        "built_in_features",
+        "dbm_read",
         // Error Tracking
         "error_tracking_read",
         // Events
@@ -318,6 +326,9 @@ mod tests {
         assert!(scopes.contains(&"apps_run"));
         assert!(scopes.contains(&"apps_write"));
         assert!(scopes.contains(&"connections_read"));
+        // Database Monitoring
+        assert!(scopes.contains(&"dbm_read"));
+        assert!(scopes.contains(&"built_in_features"));
     }
 
     #[test]
@@ -334,6 +345,8 @@ mod tests {
         assert!(ro.contains(&"dashboards_read"));
         assert!(ro.contains(&"monitors_read"));
         assert!(ro.contains(&"apps_run"));
+        assert!(ro.contains(&"dbm_read"));
+        assert!(ro.contains(&"built_in_features"));
         assert!(!ro.contains(&"org_management"));
         assert!(!ro.contains(&"teams_manage"));
         assert!(!ro.contains(&"monitors_write"));
diff --git a/src/main.rs b/src/main.rs
index 73f8985..8035e29 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1054,7 +1054,7 @@ enum Commands {
     ///   pup dbm samples search --query "dbm_type:activity service:orders env:prod" --from 1h --limit 10
     ///
     /// AUTHENTICATION:
-    ///   Requires DD_API_KEY + DD_APP_KEY.
+    ///   Accepts OAuth2 (`pup auth login`) or DD_API_KEY + DD_APP_KEY.
     #[command(verbatim_doc_comment)]
     Dbm {
         #[command(subcommand)]