diff --git a/CITATION.cff b/CITATION.cff
index 973d32f..0e7c9db 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -24,5 +24,5 @@ keywords:
   - management
   - integration
 license: Apache-2.0
-version: 26.09.2
-date-released: "2026-09-14"
+version: 26.9.3
+date-released: "2026-09-15"
diff --git a/engines/mongodb.py b/engines/mongodb.py
index 09232ba..94b5fb9 100644
--- a/engines/mongodb.py
+++ b/engines/mongodb.py
@@ -3,6 +3,7 @@
 import secrets
 from typing import Any
 
+from core.fields import Field
 from core.specs import DatabaseSpec
 from core.utils import generate_password
 from engines.base import DbEngine
@@ -14,6 +15,38 @@ class MongoEngine(DbEngine):
     template = "engines/mongodb.yml.j2"
     auth_variants = True
 
+    def option_fields(self) -> list[Field]:
+        return [
+            Field(
+                "auth_source",
+                "Auth source",
+                "text",
+                default="",
+                help=(
+                    "Authentication database, set as authSource on the URI. Leave "
+                    "empty to use admin when credentials are provided. Override if "
+                    "your user is defined in another database."
+                ),
+            ),
+            Field(
+                "replica_set",
+                "Replica set",
+                "text",
+                default="",
+                help=(
+                    "Replica set name, set as replicaSet on the URI. Required to "
+                    "connect to a self-hosted replica set."
+                ),
+            ),
+            Field(
+                "tls",
+                "Force TLS?",
+                "bool",
+                default=False,
+                help="When enabled, adds tls=true to the URI to force a TLS connection.",
+            ),
+        ]
+
     def generate(
         self, *, auth: bool, ports: PortAllocator, answers: dict[str, Any]
     ) -> DatabaseSpec:
@@ -29,6 +62,7 @@ def generate(
             database=db_name,
             username="admin" if auth else "",
             password=generate_password(16) if auth else None,
+            options=dict(answers.get("options", {})),
         )
 
     def env_vars(self, spec: DatabaseSpec) -> dict[str, str]:
diff --git a/pyproject.toml b/pyproject.toml
index d0fea3d..129faf4 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "portabase-cli"
-version = "26.09.2"
+version = "26.9.3"
 description = "The official command line interface (CLI) for managing and deploying Portabase instances with ease."
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/tests/engines/mongodb.py b/tests/engines/mongodb.py
index dce63a4..310018e 100644
--- a/tests/engines/mongodb.py
+++ b/tests/engines/mongodb.py
@@ -79,7 +79,11 @@ def fields():
         ("password", "secret", None),
     ]
     assert MONGO.fields_new() == []
-    assert MONGO.option_fields() == []
+    assert field_specs(MONGO.option_fields()) == [
+        ("auth_source", "text", ""),
+        ("replica_set", "text", ""),
+        ("tls", "bool", False),
+    ]
 
 
 def from_existing():
@@ -130,3 +134,22 @@ def compose_service_inline(render_engine):
         f"MONGO_INITDB_ROOT_PASSWORD={rendered.spec.password}",
         f"MONGO_INITDB_DATABASE={rendered.spec.database}",
     ]
+
+
+def generate_keeps_options(ports):
+    options = {"replica_set": "rs0", "tls": True}
+    spec = MONGO.generate(auth=True, ports=ports, answers={"options": options})
+    assert spec.options == options
+
+
+def only_non_default_options_reach_the_agent(ports):
+    options = {"auth_source": "", "replica_set": "rs0", "tls": False, "unknown": 1}
+    spec = MONGO.generate(auth=True, ports=ports, answers={"options": options})
+    assert MONGO.non_default_options(spec) == {"replica_set": "rs0"}
+    assert MONGO.agent_entry(spec)["options"] == {"replica_set": "rs0"}
+    tls_only = spec.with_options({"tls": True})
+    assert MONGO.agent_entry(tls_only)["options"] == {"tls": True}
+    custom_auth = spec.with_options({"auth_source": "users"})
+    assert MONGO.agent_entry(custom_auth)["options"] == {"auth_source": "users"}
+    defaults = spec.with_options({"auth_source": "", "replica_set": "", "tls": False})
+    assert "options" not in MONGO.agent_entry(defaults)
diff --git a/uv.lock b/uv.lock
index 357a540..69cc7c8 100644
--- a/uv.lock
+++ b/uv.lock
@@ -521,7 +521,7 @@ wheels = [
 
 [[package]]
 name = "portabase-cli"
-version = "26.8.12"
+version = "26.9.3"
 source = { virtual = "." }
 dependencies = [
     { name = "jinja2" },