diff --git a/README.md b/README.md
index 6258476..28febab 100644
--- a/README.md
+++ b/README.md
@@ -72,7 +72,7 @@ PgLOG.pglog("hello", PgLOG.LOGWRN)
 python -c "import rda_python_common; print(rda_python_common.__version__)"
 ```
 
-You should see the installed version (currently `2.1.8`).  If the import
+You should see the installed version (currently `2.1.9`).  If the import
 fails, double-check that the active Python environment is the one where you
 ran `pip install`.
 
diff --git a/pyproject.toml b/pyproject.toml
index 33392ab..22c94c0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_common"
-version = "2.1.8"
+version = "2.1.9"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]
@@ -32,5 +32,8 @@ pythonpath = [
   "src"
 ]
 
+[tool.setuptools.package-data]
+rda_python_common = ["*.usg"]
+
 [project.scripts]
 pgpassword = "rda_python_common.pgpassword:main"
diff --git a/src/rda_python_common/__init__.py b/src/rda_python_common/__init__.py
index 2914849..1ad368a 100644
--- a/src/rda_python_common/__init__.py
+++ b/src/rda_python_common/__init__.py
@@ -22,7 +22,7 @@
 
 from . import PgLOG, PgUtil, PgDBI, PgFile, PgLock, PgCMD, PgSIG, PgOPT, PgSplit
 
-__version__ = "2.1.8"
+__version__ = "2.1.9"
 
 __all__ = [
    "PgLOG",
diff --git a/src/rda_python_common/pgpassword.py b/src/rda_python_common/pgpassword.py
index ff69e40..43b59dd 100644
--- a/src/rda_python_common/pgpassword.py
+++ b/src/rda_python_common/pgpassword.py
@@ -64,23 +64,29 @@ def read_parameters(self):
       Parse ``sys.argv`` and apply CLI overrides.
 
       Recognized options:
-         -l URL    -- OpenBao URL (stored in self.PGDBI['BAOURL'])
-         -k TOKEN  -- OpenBao token name (stored in self.PGDBI['BAOTOKEN'])
-         -d NAME   -- PostgreSQL database name
-         -c NAME   -- PostgreSQL schema name
-         -u NAME   -- PostgreSQL login user name
-         -h HOST   -- PostgreSQL server host name
-         -p PORT   -- PostgreSQL port number
+         -? / --help -- show usage and exit
+         -l URL      -- OpenBao URL (stored in self.PGDBI['BAOURL'])
+         -k TOKEN    -- OpenBao token name (stored in self.PGDBI['BAOTOKEN'])
+         -d NAME     -- PostgreSQL database name
+         -c NAME     -- PostgreSQL schema name
+         -u NAME     -- PostgreSQL login user name
+         -h HOST     -- PostgreSQL server host name
+         -p PORT     -- PostgreSQL port number
 
-      If no arguments are supplied a usage message is printed and the
-      process exits with status 0. Unknown options or stray values
-      cause an immediate error exit via ``self.pglog(..., LGEREX)``.
+      With no arguments, all defaults inherited from PgDBI/PgLOG are
+      used and the password lookup proceeds. Unknown options, stray
+      values, or an option without its required value cause an
+      immediate error exit via ``self.pglog(..., LGEREX)``.
       """
       argv = sys.argv[1:]
       opt = None
-      dohelp = True
       for arg in argv:
-         if re.match(r'^-[a-zA-Z]$', arg):
+         if arg in ('-?', '-help', '--help'):
+            self.set_help_path(__file__)
+            self.show_usage("pgpassword")
+         elif re.match(r'^-[a-zA-Z]$', arg):
+            if opt:
+               self.pglog("-" + opt + ": missing option value", self.LGEREX)
             opt = arg[1:]
          elif opt:
             if opt == 'l':
@@ -91,13 +97,12 @@ def read_parameters(self):
                self.dbopt = True
                self.DBINFO[self.DBFLDS[opt]] = arg
             else:
-               self.pglog(arg + ": Unknown option", self.LGEREX)
-            dohelp = False
+               self.pglog("-" + opt + ": Unknown option", self.LGEREX)
+            opt = None
          else:
-            self.pglog(arg + ": Value provided without option", self.LGEREX)
-      if dohelp:
-         self.set_help_path(__file__)
-         self.show_usage("pgpassword")
+            self.pglog(arg + ": value provided without option", self.LGEREX)
+      if opt:
+         self.pglog("-" + opt + ": missing option value", self.LGEREX)
 
    # get the pgpassword
    def start_actions(self):
@@ -114,7 +119,7 @@ def start_actions(self):
       self.password = self.get_baopassword()
       if not self.password: self.password = self.get_pgpassword()
 
-# main function to excecute this script
+# main function to execute this script
 def main():
    """Entry point for the ``pgpassword`` console script: print the retrieved password to stdout."""
    object = PgPassword()
diff --git a/src/rda_python_common/pgpassword.usg b/src/rda_python_common/pgpassword.usg
index 1661040..2ab8eaf 100644
--- a/src/rda_python_common/pgpassword.usg
+++ b/src/rda_python_common/pgpassword.usg
@@ -5,9 +5,15 @@
  file.  The retrieved password is printed to stdout so that shell
  wrappers and other RDA utilities can capture it.
 
- Usage: pgpassword [-l OpenBaoURL] [-k TokenName] [-d DBNAME]   \
+ Usage: pgpassword [-?] [-l OpenBaoURL] [-k TokenName] [-d DBNAME]   \
                    [-c SCHEMA] [-u USName] [-h DBHOST] [-p DBPORT]
 
+ With no options, pgpassword retrieves the password using all defaults
+ inherited from PgDBI/PgLOG (see per-option defaults below).
+
+      - Option -?, show this usage information and exit (also -help
+          and --help);
+
       - Option -l, OpenBao URL used to retrieve passwords. Overrides
           the BAOURL value from the PgDBI configuration.
           Default: https://bao.k8s.ucar.edu/
@@ -33,8 +39,7 @@
           Default: 5432
 
  If any of -d, -c, -u, -h, or -p is supplied, the values are applied
- via default_scinfo() before the password lookup is performed.  With no
- arguments, this usage information is displayed and the program exits.
+ via default_scinfo() before the password lookup is performed.
 
  Examples: