diff --git a/docs/command-reference.asciidoc b/docs/command-reference.asciidoc
index e8f7df12f42..f3c030ffb4c 100644
--- a/docs/command-reference.asciidoc
+++ b/docs/command-reference.asciidoc
@@ -34,6 +34,7 @@ ifdef::serverless[]
 endif::serverless[]
 
 :help-command-short-desc: Shows help for any command
+:keystore-command-short-desc: Manages the <<keystore,secrets keystore>>
 :modules-command-short-desc: Manages configured modules
 :package-command-short-desc: Packages the configuration and executable into a zip file
 :remove-command-short-desc: Removes the specified function from your serverless environment
@@ -106,6 +107,9 @@ ifdef::apm-server[]
 endif::[]
 |<<export-command,`export`>> |{export-command-short-desc}.
 |<<help-command,`help`>> |{help-command-short-desc}.
+ifndef::serverless[]
+|<<keystore-command,`keystore`>> |{keystore-command-short-desc}.
+endif::[]
 ifeval::["{beatname_lc}"=="functionbeat"]
 |<<package-command,`package`>> |{package-command-short-desc}.
 |<<remove-command,`remove`>> |{remove-command-short-desc}.
@@ -430,6 +434,65 @@ Specifies the name of the command to show help for.
 {beatname_lc} help export
 -----
 
+ifndef::serverless[]
+[float]
+[[keystore-command]]
+==== `keystore` command
+
+{keystore-command-short-desc}.
+
+*SYNOPSIS*
+
+["source","sh",subs="attributes"]
+----
+{beatname_lc} keystore SUBCOMMAND [FLAGS]
+----
+
+*`SUBCOMMAND`*
+
+*`add KEY`*::
+Adds the specified key to the keystore. Use the `--force` flag to overwrite an
+existing key. Use the `--stdin` flag to pass the value through `stdin`.
+
+*`create`*::
+Creates a keystore to hold secrets. Use the `--force` flag to overwrite the
+existing keystore.
+
+*`list`*::
+Lists the keys in the keystore.
+
+*`remove KEY`*::
+Removes the specified key from the keystore.
+
+*FLAGS*
+
+*`--force`*::
+Valid with the `add` and `create` subcommands. When used with `add`, overwrites
+the specified key. When used with `create`, overwrites the keystore.
+
+*`--stdin`*::
+When used with `add`, uses the stdin as the source of the key's value.
+
+*`-h, --help`*::
+Shows help for the `keystore` command.
+
+
+{global-flags}
+
+*EXAMPLES*
+
+["source","sh",subs="attributes"]
+-----
+{beatname_lc} keystore create
+{beatname_lc} keystore add ES_PWD
+{beatname_lc} keystore remove ES_PWD
+{beatname_lc} keystore list
+-----
+
+See <<keystore>> for more examples.
+
+endif::[]
+
 ifeval::["{beatname_lc}"=="functionbeat"]
 [float]
 [[package-command]]
diff --git a/docs/keystore.asciidoc b/docs/keystore.asciidoc
index 2cd74ddea6a..071f9c928a3 100644
--- a/docs/keystore.asciidoc
+++ b/docs/keystore.asciidoc
@@ -35,8 +35,8 @@ name, the APM Server keystore lets you specify arbitrary names that you can
 reference in the APM Server configuration.
 
 To create and manage keys, use the `keystore` command.
-// See the <<keystore-command,command reference>> for the full command syntax,
-// including optional flags.
+See the <<keystore-command,command reference>> for the full command syntax,
+including optional flags.
 
 NOTE: The `keystore` command must be run by the same user who will run
 APM Server.