diff --git a/rust/pvverify/build.rs b/rust/pvverify/build.rs
index aefdb87f..131f0767 100644
--- a/rust/pvverify/build.rs
+++ b/rust/pvverify/build.rs
@@ -6,7 +6,7 @@
 use std::env;
 use std::io::Error;
 
-use clap::{CommandFactory, ValueEnum};
+use clap::CommandFactory;
 use clap_complete::{generate_to, Shell};
 
 include!("src/cli.rs");
diff --git a/rust/pvverify/src/cli.rs b/rust/pvverify/src/cli.rs
index b9c52e4c..18c6d755 100644
--- a/rust/pvverify/src/cli.rs
+++ b/rust/pvverify/src/cli.rs
@@ -3,11 +3,36 @@
 // Copyright IBM Corp. 2025
 use std::sync::OnceLock;
 
-use clap::{ArgAction, Parser};
-use utils::CertificateOptions;
+use clap::{ArgAction, Parser, ValueEnum};
+use utils::{
+    AutoOrExplicit, AutoOrExplicitParser, CertificateOptions, HkdVersion, ValueEnumDisplay,
+    ValueEnumFromStr,
+};
 
 static VERSION: OnceLock<String> = OnceLock::new();
 
+/// Secure Execution HostKey version for CLI
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum, ValueEnumDisplay, ValueEnumFromStr)]
+pub enum HostKeyVersion {
+    #[value(name = "1")]
+    /// Version 1 - uses traditional cryptographic keys
+    V1,
+    #[value(name = "2")]
+    /// Version 2 - uses hybrid (post-quantum) cryptographic keys
+    V2,
+}
+pub type HostKeyVersionSelection = AutoOrExplicit<HostKeyVersion>;
+pub type HostKeyVersionSelectionParser = AutoOrExplicitParser<HostKeyVersion>;
+
+impl From<HostKeyVersion> for HkdVersion {
+    fn from(val: HostKeyVersion) -> Self {
+        match val {
+            HostKeyVersion::V1 => Self::Classical,
+            HostKeyVersion::V2 => Self::Hybrid,
+        }
+    }
+}
+
 #[derive(Parser, Debug)]
 #[command(long_version=ver(), disable_version_flag(true))]
 /// Tool to verify host-keys
@@ -23,6 +48,10 @@ pub struct CliOptions {
     #[arg(long, action=ArgAction::Version)]
     /// Print version information and exit.
     version: (),
+
+    /// Specify the Host-key version to use.
+    #[arg(long = "hkd-version", value_name = "VERSION", default_value_t = HostKeyVersionSelection::Auto, value_parser = HostKeyVersionSelectionParser::default())]
+    pub hkd_version: HostKeyVersionSelection,
 }
 
 fn ver() -> &'static str {
diff --git a/rust/pvverify/src/main.rs b/rust/pvverify/src/main.rs
index bb9131eb..2180b1d6 100644
--- a/rust/pvverify/src/main.rs
+++ b/rust/pvverify/src/main.rs
@@ -14,9 +14,9 @@ static LOGGER: PvLogger = PvLogger;
 
 fn main() -> Result<()> {
     LOGGER.start(LevelFilter::Trace)?;
-    cli::CliOptions::parse()
-        .certificate_args
-        .get_verified_hkds("info")?;
+    let opt = cli::CliOptions::parse();
+    opt.certificate_args
+        .get_verified_hkds_new("info", opt.hkd_version.map(|v| v.into()))?;
     info!("Host-key documents verified.");
     Ok(())
 }