diff --git a/CHANGELOG b/CHANGELOG
index c55e4f283..989c07c80 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -38,6 +38,10 @@ o [Nping] Address build failure under libc++ due to "using namespace std;" in
 o [Ncat][GH#1868] Fix a fatal error when connecting to a Linux VM socket with
   verbose output enabled. [Stefano Garzarella]
 
+o [Ncat][GH#2060] Proxy credentials can be alternatively passed onto Ncat by
+  setting environment variable NCAT_PROXY_AUTH, which reduces the risk of the
+  credentials getting captured in process logs. [nnposter]
+
 o [NSE][GH#1723] Fixed a crash on Windows when processing a GZIP-encoded HTTP
   body. [Daniel Miller]
 
diff --git a/ncat/docs/ncat.xml b/ncat/docs/ncat.xml
index 23bb009bf..cfc0137f5 100644
--- a/ncat/docs/ncat.xml
+++ b/ncat/docs/ncat.xml
@@ -481,6 +481,11 @@
           <option>--proxy-type socks5</option>, the form should be
           username:password.  For
           <option>--proxy-type socks4</option>, it should be a username only.</para>
+          <para>These credentials can be alternatively passed onto Ncat by
+          setting environment variable
+          <envar>NCAT_PROXY_AUTH</envar><indexterm><primary><envar>NCAT_PROXY_AUTH</envar> environment variable</primary></indexterm>,
+          which reduces the risk of the credentials being captured in process
+          logs.  (Option <option>--proxy-auth</option>takes precedence.)</para>
         </listitem>
       </varlistentry>
 
diff --git a/ncat/ncat_main.c b/ncat/ncat_main.c
index ee06f0130..d1fff7e7e 100644
--- a/ncat/ncat_main.c
+++ b/ncat/ncat_main.c
@@ -823,6 +823,9 @@ int main(int argc, char *argv[])
         }
     }
 
+    if (!o.proxy_auth)
+        o.proxy_auth = getenv("NCAT_PROXY_AUTH");
+
     if (o.zerobyte) {
       if (o.listen)
         bye("Services designed for LISTENING can't be used with -z");