diff --git a/Makefile b/Makefile
index db8f45bc0..93b7cfb54 100644
--- a/Makefile
+++ b/Makefile
@@ -40,17 +40,9 @@ test:
 
 # AUTOMATIC TAG
 sdk-tag-services:
-	@if [ "${password}" = "" ]; then \
-        go run $(SCRIPTS_BASE)/automatic_tag.go --update-type ${update-type} --ssh-private-key-file-path ${ssh-private-key-file-path}; \
-    else \
-        go run $(SCRIPTS_BASE)/automatic_tag.go --update-type ${update-type} --ssh-private-key-file-path ${ssh-private-key-file-path} --password ${password}; \
-    fi
+	@go run $(SCRIPTS_BASE)/automatic_tag.go --update-type ${update-type} --ssh-private-key-file-path ${ssh-private-key-file-path};
 
 
 sdk-tag-core: 
-	@if [ "${password}" = "" ]; then \
-        go run $(SCRIPTS_BASE)/automatic_tag.go --update-type ${update-type} --ssh-private-key-file-path ${ssh-private-key-file-path} --target core; \
-    else \
-        go run $(SCRIPTS_BASE)/automatic_tag.go --update-type ${update-type} --ssh-private-key-file-path ${ssh-private-key-file-path} --target core --password ${password}; \
-    fi
+	@go run $(SCRIPTS_BASE)/automatic_tag.go --update-type ${update-type} --ssh-private-key-file-path ${ssh-private-key-file-path} --target core;
 	
diff --git a/scripts/automatic_tag.go b/scripts/automatic_tag.go
index 47e844129..9933a0000 100644
--- a/scripts/automatic_tag.go
+++ b/scripts/automatic_tag.go
@@ -7,12 +7,14 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"syscall"
 
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/transport/ssh"
 	"golang.org/x/mod/semver"
+	"golang.org/x/term"
 )
 
 const (
@@ -24,14 +26,13 @@ const (
 
 	updateTypeFlag            = "update-type"
 	sshPrivateKeyFilePathFlag = "ssh-private-key-file-path"
-	passwordFlag              = "password"
 	targetFlag                = "target"
 )
 
 var (
 	updateTypes = []string{minor, patch}
 	targets     = []string{allServices, core}
-	usage       = "go run automatic_tag.go --update-type [minor|patch] --ssh-private-key-file-path path/to/private-key --password password --target [all-services|core]"
+	usage       = "go run automatic_tag.go --update-type [minor|patch] --ssh-private-key-file-path path/to/private-key --target [all-services|core]"
 )
 
 func main() {
@@ -44,12 +45,10 @@ func main() {
 func run() error {
 	var updateType string
 	var sshPrivateKeyFilePath string
-	var password string
 	var target string
 
 	flag.StringVar(&updateType, updateTypeFlag, "", fmt.Sprintf("Update type, must be one of: %s (required)", strings.Join(updateTypes, ",")))
 	flag.StringVar(&sshPrivateKeyFilePath, sshPrivateKeyFilePathFlag, "", "Path to the ssh private key (required)")
-	flag.StringVar(&password, passwordFlag, "", "Password of the ssh private key (optional)")
 	flag.StringVar(&target, targetFlag, allServices, fmt.Sprintf("Create tags for this target, must be one of %s (optional, default is %s)", strings.Join(targets, ","), allServices))
 
 	flag.Parse()
@@ -81,13 +80,31 @@ func run() error {
 		return fmt.Errorf("the provided private key file path %s is not valid: %w\nUsage: %s", sshPrivateKeyFilePath, err, usage)
 	}
 
+	password, err := promptForPassword()
+	if err != nil {
+		return fmt.Errorf("prompt for password: %s", err.Error())
+	}
+
+	fmt.Println("Starting automatic tag update...")
+
 	err = automaticTagUpdate(updateType, sshPrivateKeyFilePath, password, target)
 	if err != nil {
-		return fmt.Errorf("updating tags: %s", err.Error())
+		return fmt.Errorf("update tags: %s", err.Error())
 	}
 	return nil
 }
 
+// Prompts the user for the ssh key password.
+func promptForPassword() (string, error) {
+	fmt.Print("Enter SSH key passphrase (empty for no passphrase): ")
+	defer fmt.Print("\n")
+	bytePassword, err := term.ReadPassword(int(syscall.Stdin))
+	if err != nil {
+		return "", fmt.Errorf("read password: %w", err)
+	}
+	return string(bytePassword), nil
+}
+
 // automaticTagUpdate goes through all of the existing tags, gets the latest for the target, creates a new one according to the updateType and pushes them
 func automaticTagUpdate(updateType, sshPrivateKeyFilePath, password, target string) error {
 	tempDir, err := os.MkdirTemp("", "")
diff --git a/scripts/go.mod b/scripts/go.mod
index 53336c0f1..178e30b91 100644
--- a/scripts/go.mod
+++ b/scripts/go.mod
@@ -2,7 +2,10 @@ module github.com/stackitcloud/stackit-sdk-go/scripts
 
 go 1.18
 
-require github.com/go-git/go-git/v5 v5.11.0
+require (
+	github.com/go-git/go-git/v5 v5.11.0
+	golang.org/x/term v0.17.0
+)
 
 require (
 	dario.cat/mergo v1.0.0 // indirect
diff --git a/scripts/go.sum b/scripts/go.sum
index d8e51f12e..2050f5426 100644
--- a/scripts/go.sum
+++ b/scripts/go.sum
@@ -104,6 +104,7 @@ golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=