diff --git a/tools/fix_auth/auth_model.rb b/tools/fix_auth/auth_model.rb
index 9e37d55694d..471423af6d6 100644
--- a/tools/fix_auth/auth_model.rb
+++ b/tools/fix_auth/auth_model.rb
@@ -87,6 +87,7 @@ def run(options = {})
         puts "fixing #{table_name}.#{available_columns.join(", ")}" unless options[:silent]
         processed = 0
         errors = 0
+        would_make_changes = false
         contenders.each do |r|
           begin
             fix_passwords(r, options)
@@ -96,6 +97,7 @@ def run(options = {})
                 display_column(r, column, options)
               end
             end
+            would_make_changes ||= r.changed?
             r.save! if !options[:dry_run] && r.changed?
             processed += 1
           rescue ArgumentError # undefined class/module
@@ -111,6 +113,7 @@ def run(options = {})
         end
         puts "#{options[:dry_run] ? "viewed" : "processed"} #{processed} records" unless options[:silent]
         puts "found #{errors} errors" if errors > 0 && !options[:silent]
+        puts "** This was executed in dry-run, and no actual changes will be made to #{table_name} **" if would_make_changes && options[:dry_run]
       end
 
       def clean_up
diff --git a/tools/fix_auth/fix_auth.rb b/tools/fix_auth/fix_auth.rb
index 46d5ba4b56e..36ba21cf432 100644
--- a/tools/fix_auth/fix_auth.rb
+++ b/tools/fix_auth/fix_auth.rb
@@ -50,7 +50,15 @@ def generate_password
       raise Errno::EEXIST, e.message
     end
 
+    def print_dry_run_warning
+      method = caller_locations.first.label
+      # Move this message up to `run` if the other methods add dry-run support
+      puts "** #{method} is executing in dry-run mode, and no actual changes will be made **" if options[:dry_run]
+    end
+
     def fix_database_passwords
+      print_dry_run_warning
+
       begin
         # in specs, this is already setup
         ActiveRecord::Base.connection_config
@@ -65,6 +73,7 @@ def fix_database_passwords
     end
 
     def fix_database_yml
+      print_dry_run_warning
       FixDatabaseYml.file_name = "#{options[:root]}/config/database.yml"
       FixDatabaseYml.run({:hardcode => options[:password]}.merge(run_options))
     end