diff --git a/cmd/root.go b/cmd/root.go
index 28a48213a..f6bbce364 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -487,6 +487,8 @@ the Proxy will then pick-up automatically.`)
 		"Enables health check endpoints /startup, /liveness, and /readiness on localhost.")
 	localFlags.StringVar(&c.conf.APIEndpointURL, "sqladmin-api-endpoint", "",
 		"API endpoint for all Cloud SQL Admin API requests. (default: https://sqladmin.googleapis.com)")
+	localFlags.StringVar(&c.conf.UniverseDomain, "universe-domain", "",
+		"Universe Domain for TPC environments. (default: googleapis.com)")
 	localFlags.StringVar(&c.conf.QuotaProject, "quota-project", "",
 		`Specifies the project to use for Cloud SQL Admin API quota tracking.
 The IAM principal must have the "serviceusage.services.use" permission
@@ -787,6 +789,9 @@ and re-try with just --auto-iam-authn`)
 		conf.UserAgent = userAgent
 	}
 
+	if userHasSetLocal(cmd, "sqladmin-api-endpoint") && userHasSetLocal(cmd, "universe-domain") {
+		return newBadCommandError("cannot specify --sqladmin-api-endpoint and --universe-domain at the same time")
+	}
 	if userHasSetLocal(cmd, "sqladmin-api-endpoint") && conf.APIEndpointURL != "" {
 		_, err := url.Parse(conf.APIEndpointURL)
 		if err != nil {
diff --git a/cmd/root_test.go b/cmd/root_test.go
index d2dc71218..a3ca4ce98 100644
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -264,6 +264,13 @@ func TestNewCommandArguments(t *testing.T) {
 				APIEndpointURL: "https://test.googleapis.com/",
 			}),
 		},
+		{
+			desc: "using the universe domain flag",
+			args: []string{"--universe-domain", "test-universe.test", "proj:region:inst"},
+			want: withDefaults(&proxy.Config{
+				UniverseDomain: "test-universe.test",
+			}),
+		},
 		{
 			desc: "using the unix socket flag",
 			args: []string{"--unix-socket", "/path/to/dir/", "proj:region:inst"},
@@ -1189,6 +1196,12 @@ func TestNewCommandWithErrors(t *testing.T) {
 				"--fuse", "myfusedir",
 			},
 		},
+		{
+			desc: "using both --sqladmin-api-endpoint and --universe-domain",
+			args: []string{
+				"--sqladmin-api-endpoint", "https://sqladmin.googleapis.com",
+				"--universe-domain", "test-universe.test", "proj:region:inst"},
+		},
 	}
 
 	for _, tc := range tcs {
diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go
index dfa0c08b0..11b4e98b5 100644
--- a/internal/proxy/proxy.go
+++ b/internal/proxy/proxy.go
@@ -144,6 +144,10 @@ type Config struct {
 	// the proxy will use the main public api: https://sqladmin.googleapis.com/
 	APIEndpointURL string
 
+	// UniverseDomain is the universe domain for the TPC environment. When left
+	// blank, the proxy will use the Google Default Universe (GDU): googleapis.com
+	UniverseDomain string
+
 	// UnixSocket is the directory where Unix sockets will be created,
 	// connected to any Instances. If set, takes precedence over Addr and Port.
 	UnixSocket string
@@ -408,6 +412,10 @@ func (c *Config) DialerOptions(l cloudsql.Logger) ([]cloudsqlconn.Option, error)
 		opts = append(opts, cloudsqlconn.WithAdminAPIEndpoint(c.APIEndpointURL))
 	}
 
+	if c.UniverseDomain != "" {
+		opts = append(opts, cloudsqlconn.WithUniverseDomain(c.UniverseDomain))
+	}
+
 	if c.IAMAuthN {
 		opts = append(opts, cloudsqlconn.WithIAMAuthN())
 	}