diff --git a/cmd/relayfile-cli/main.go b/cmd/relayfile-cli/main.go
index 9f0aa45b..bc2353e9 100644
--- a/cmd/relayfile-cli/main.go
+++ b/cmd/relayfile-cli/main.go
@@ -1245,15 +1245,14 @@ func runAgentRelayJSON(args []string, out any) error {
 	return nil
 }
 
-func runAgentRelayLogin(stdin io.Reader, stdout io.Writer, noOpen bool) error {
+func runAgentRelayLogin(stdin io.Reader, stdout io.Writer, _ bool) error {
 	if err := ensureAgentRelayCLICompatible(); err != nil {
 		return err
 	}
-	args := []string{"cloud", "login"}
-	if noOpen {
-		args = append(args, "--no-open")
-	}
-	cmd := exec.Command(agentRelayBinary(), args...)
+	// Keep relayfile's --no-open flag for headless callers, but do not forward it:
+	// agent-relay cloud login does not support that flag and prints the sign-in URL
+	// itself when a browser cannot be opened.
+	cmd := exec.Command(agentRelayBinary(), "cloud", "login")
 	cmd.Stdin = stdin
 	cmd.Stdout = stdout
 	cmd.Stderr = stdout
@@ -2574,7 +2573,7 @@ func runLogin(args []string, stdin io.Reader, stdout io.Writer) error {
 	cloudAPIURL := fs.String("cloud-api-url", envOrDefault("RELAYFILE_CLOUD_API_URL", defaultCloudAPIURL), "Relayfile Cloud API URL")
 	cloudToken := fs.String("cloud-token", strings.TrimSpace(os.Getenv("RELAYFILE_CLOUD_TOKEN")), "Relayfile Cloud access token; skips browser login when set")
 	apiKey := fs.Bool("api-key", false, "use the legacy API-key flow against --server instead of the cloud browser login")
-	noOpen := fs.Bool("no-open", false, "print the cloud sign-in URL instead of opening it")
+	noOpen := fs.Bool("no-open", false, "accepted for headless compatibility; Agent Relay controls browser behavior")
 	loginTimeout := fs.Duration("login-timeout", 5*time.Minute, "cloud login timeout")
 	workspaceFlag := fs.String("workspace", "", "workspace name or id to refresh; defaults to the active workspace")
 	skipWorkspace := fs.Bool("skip-workspace-refresh", false, "sign into the cloud only; do not refresh the workspace token")
diff --git a/cmd/relayfile-cli/main_test.go b/cmd/relayfile-cli/main_test.go
index 71b4e9c2..374b48cf 100644
--- a/cmd/relayfile-cli/main_test.go
+++ b/cmd/relayfile-cli/main_test.go
@@ -4446,7 +4446,7 @@ func TestLoginCanProvisionSeparateWorkspaceForMessagingOnlyRelaycastWorkspace(t
 
 	resolverFailure := agentRelayResolver404Error(workspaceKey, relayfileCLITestFixture(t, "cloud-workspace-not-found.json"))
 	installFakeAgentRelay(t, fmt.Sprintf(`
-if [ "$*" = "cloud login --no-open" ]; then
+if [ "$*" = "cloud login" ]; then
   echo "agent-relay login ok"
   exit 0
 fi
@@ -6705,6 +6705,10 @@ func TestLoginDelegatesToAgentRelay(t *testing.T) {
 	installFakeAgentRelay(t, `
 printf '%s\n' "$*" >> "$AGENT_RELAY_LOG"
 if [ "$*" = "cloud login --no-open" ]; then
+  echo "error: unknown option '--no-open'" >&2
+  exit 1
+fi
+if [ "$*" = "cloud login" ]; then
   echo "agent-relay login ok"
   exit 0
 fi
@@ -6743,11 +6747,14 @@ exit 2
 		t.Fatalf("read fake agent-relay log failed: %v", err)
 	}
 	gotLog := strings.TrimSpace(string(logBytes))
-	for _, want := range []string{"cloud login --no-open", "cloud session --json", "workspace active --json"} {
+	for _, want := range []string{"cloud login", "cloud session --json", "workspace active --json"} {
 		if !strings.Contains(gotLog, want) {
 			t.Fatalf("expected agent-relay %s call, got %q", want, string(logBytes))
 		}
 	}
+	if strings.Contains(gotLog, "cloud login --no-open") {
+		t.Fatalf("relayfile must not forward --no-open to agent-relay cloud login, got %q", gotLog)
+	}
 	if _, err := os.Stat(cloudCredentialsPath()); !os.IsNotExist(err) {
 		t.Fatalf("expected stale relayfile cloud credentials removed, got err=%v", err)
 	}