diff --git a/rust/pvimg/src/cli.rs b/rust/pvimg/src/cli.rs
index ebde7957..bb64c96e 100644
--- a/rust/pvimg/src/cli.rs
+++ b/rust/pvimg/src/cli.rs
@@ -93,6 +93,31 @@ pub struct ComponentPaths {
     pub parmfile: Option<PathBuf>,
 }
 
+/// CLI Argument collection for handling user-provided keys.
+#[derive(Args, Debug)]
+#[cfg_attr(test, derive(Default))]
+pub struct UserKeys {
+    /// Use the content of FILE as the customer-communication key (CCK).
+    ///
+    /// The file must contain exactly 32 bytes of data. In previous versions,
+    /// this option was called '--comm-key'.
+    #[arg(
+        long,
+        value_name = "FILE",
+        group = "cck-available",
+        visible_alias = "comm-key"
+    )]
+    pub cck: Option<PathBuf>,
+
+    /// Use the content of FILE as the Secure Execution header protection key.
+    ///
+    /// The file must contain exactly 32 bytes of data. If the option is not
+    /// specified, the Secure Execution header protection key is a randomly
+    /// generated key.
+    #[arg(long, value_name = "FILE", alias = "x-header-key")]
+    pub hdr_key: Option<PathBuf>,
+}
+
 #[derive(Args, Debug)]
 #[cfg_attr(test, derive(Default))]
 #[command(
@@ -342,25 +367,8 @@ pub struct CreateBootImageArgs {
     #[arg(long)]
     pub overwrite: bool,
 
-    /// Use the content of FILE as the customer-communication key (CCK).
-    ///
-    /// The file must contain exactly 32 bytes of data. In previous versions,
-    /// this option was called '--comm-key'.
-    #[arg(
-        long,
-        value_name = "FILE",
-        group = "cck-available",
-        visible_alias = "comm-key"
-    )]
-    pub cck: Option<PathBuf>,
-
-    /// Use the content of FILE as the Secure Execution header protection key.
-    ///
-    /// The file must contain exactly 32 bytes of data. If the option is not
-    /// specified, the Secure Execution header protection key is a randomly
-    /// generated key.
-    #[arg(long, value_name = "FILE", alias = "x-header-key")]
-    pub hdr_key: Option<PathBuf>,
+    #[clap(flatten)]
+    pub keys: UserKeys,
 
     #[clap(flatten)]
     pub legacy_flags: CreateBootImageLegacyFlags,
diff --git a/rust/pvimg/src/cmd/common.rs b/rust/pvimg/src/cmd/common.rs
index 8da99d63..d1cb25c7 100644
--- a/rust/pvimg/src/cmd/common.rs
+++ b/rust/pvimg/src/cmd/common.rs
@@ -2,13 +2,13 @@
 //
 // Copyright IBM Corp. 2024
 
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 use anyhow::Result;
 use log::info;
 use pv::{misc::read_file, request::Confidential};
 
-use crate::cli::CreateBootImageExperimentalArgs;
+use crate::cli::{CreateBootImageExperimentalArgs, UserKeys};
 
 #[macro_export]
 /// Makes it easier to
@@ -24,8 +24,7 @@ pub struct UserProvidedKeys {
 
 /// Reads all user provided keys.
 pub fn read_user_provided_keys(
-    cck_path: Option<&Path>,
-    hdr_key_path: Option<&Path>,
+    keys: &UserKeys,
     experimental_args: &CreateBootImageExperimentalArgs,
 ) -> Result<UserProvidedKeys> {
     let components_key = {
@@ -44,7 +43,7 @@ pub fn read_user_provided_keys(
         }
     };
     let aead_key = {
-        match hdr_key_path {
+        match &keys.hdr_key {
             Some(key_path) => {
                 info!(
                     "Use file '{}' as the Secure Execution header protection",
@@ -63,7 +62,7 @@ pub fn read_user_provided_keys(
     };
 
     let cck = {
-        match cck_path {
+        match &keys.cck {
             Some(key_path) => {
                 info!(
                     "Use file '{}' as the customer communication key (CCK)",
diff --git a/rust/pvimg/src/cmd/create.rs b/rust/pvimg/src/cmd/create.rs
index 40afcee7..43871c37 100644
--- a/rust/pvimg/src/cmd/create.rs
+++ b/rust/pvimg/src/cmd/create.rs
@@ -126,11 +126,7 @@ pub fn create(opt: &CreateBootImageArgs) -> Result<OwnExitCode> {
     let verified_host_keys = opt
         .certificate_args
         .get_verified_hkds("Secure Execution image")?;
-    let user_provided_keys = read_user_provided_keys(
-        opt.cck.as_deref(),
-        opt.hdr_key.as_deref(),
-        &opt.experimental_args,
-    )?;
+    let user_provided_keys = read_user_provided_keys(&opt.keys, &opt.experimental_args)?;
     let (plaintext_flags, secret_flags) = parse_flags(opt)?;
 
     if plaintext_flags.is_set(PcfV1::NoComponentEncryption) {