diff --git a/strix/interface/cloud/spec.py b/strix/interface/cloud/spec.py
index 693bba6c..2e1aa16f 100644
--- a/strix/interface/cloud/spec.py
+++ b/strix/interface/cloud/spec.py
@@ -110,9 +110,10 @@ _TEST_USER_BODY = (
 )
 
 _GIT_TOKEN_BODY = (
-    P("token", required=True, help="Provider access token.", flag="provider-token"),
-    P("instance_url", help="Base URL for a self-hosted instance."),
-    P("workspace", help="Bitbucket workspace name."),
+    P("access_token", required=True, help="Provider access token.", flag="provider-token"),
+    P("instance_url", help="GitLab base URL, for example https://gitlab.com."),
+    P("account_email", help="Bitbucket account email address."),
+    P("installation_id", "int", help="Existing installation ID to update."),
 )
 
 
diff --git a/tests/test_cloud_cli.py b/tests/test_cloud_cli.py
index 660cb65d..3f74ff77 100644
--- a/tests/test_cloud_cli.py
+++ b/tests/test_cloud_cli.py
@@ -296,10 +296,45 @@ def test_required_secret_body_field_can_come_from_stdin(
         return FakeResponse(payload={"ok": True})
 
     monkeypatch.setattr(http, "request", fake_request)
-    monkeypatch.setattr("sys.stdin", io.StringIO('{"token":"provider-secret"}'))
+    monkeypatch.setattr("sys.stdin", io.StringIO('{"access_token":"provider-secret"}'))
 
     assert cloud.run_cloud(["integrations", "connect", "gitlab", "--data", "-", "--json"]) == 0
-    assert seen["body"] == {"token": "provider-secret"}
+    assert seen["body"] == {"access_token": "provider-secret"}
+
+
+def test_provider_token_does_not_override_strix_api_auth(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    seen: dict[str, Any] = {}
+
+    def fake_request(_method: str, _path: str, **kwargs: Any) -> FakeResponse:
+        seen.update(token=kwargs.get("token"), body=kwargs.get("body"))
+        return FakeResponse(payload={"ok": True})
+
+    monkeypatch.setattr(http, "request", fake_request)
+
+    assert (
+        cloud.run_cloud(
+            [
+                "integrations",
+                "connect",
+                "gitlab",
+                "--provider-token",
+                "provider-secret",
+                "--instance-url",
+                "https://gitlab.com",
+                "--json",
+            ]
+        )
+        == 0
+    )
+    assert seen == {
+        "token": None,
+        "body": {
+            "access_token": "provider-secret",
+            "instance_url": "https://gitlab.com",
+        },
+    }
 
 
 def test_required_body_field_is_validated_after_data_merge(capsys: Any) -> None:
diff --git a/tests/test_completions.py b/tests/test_completions.py
index 69b1a082..f9f9157e 100644
--- a/tests/test_completions.py
+++ b/tests/test_completions.py
@@ -81,6 +81,16 @@ def test_exact_verbs_that_are_also_prefixes_keep_their_subverbs() -> None:
 
 
 def test_contract_fix_flags_are_completed() -> None:
+    integration_connect = completion_candidates(
+        ["cloud", "integrations", "connect", "gitlab", "--"]
+    )
+    assert {
+        "--provider-token",
+        "--instance-url",
+        "--account-email",
+        "--installation-id",
+    } <= set(integration_connect)
+
     disconnect = completion_candidates(["cloud", "integrations", "disconnect", "--"])
     assert "--installation-id" in disconnect