diff --git a/cmd/thanos/config.go b/cmd/thanos/config.go
index b53da505de..bcc06faecd 100644
--- a/cmd/thanos/config.go
+++ b/cmd/thanos/config.go
@@ -56,7 +56,7 @@ func (hc *httpConfig) registerFlag(cmd extkingpin.FlagClause) *httpConfig {
 		"Time to wait after an interrupt received for HTTP Server.").
 		Default("2m").SetValue(&hc.gracePeriod)
 	cmd.Flag(
-		"http-tls-config",
+		"http.config",
 		"[EXPERIMENTAL] Path to the configuration file that can enable TLS or authentication for all HTTP endpoints.",
 	).Default("").StringVar(&hc.tlsConfig)
 	return hc
diff --git a/docs/components/compact.md b/docs/components/compact.md
index 126c37297a..ba7c183ac8 100644
--- a/docs/components/compact.md
+++ b/docs/components/compact.md
@@ -377,7 +377,7 @@ Flags:
                                 Listen host:port for HTTP endpoints.
       --http-grace-period=2m    Time to wait after an interrupt received for
                                 HTTP Server.
-      --http-tls-config=""      [EXPERIMENTAL] Path to the configuration file
+      --http.config=""          [EXPERIMENTAL] Path to the configuration file
                                 that can enable TLS or authentication for all
                                 HTTP endpoints.
       --log.format=logfmt       Log format to use. Possible options: logfmt or
diff --git a/docs/components/query-frontend.md b/docs/components/query-frontend.md
index ede867a9b6..93fbcc0048 100644
--- a/docs/components/query-frontend.md
+++ b/docs/components/query-frontend.md
@@ -136,7 +136,7 @@ Flags:
                                  Listen host:port for HTTP endpoints.
       --http-grace-period=2m     Time to wait after an interrupt received for
                                  HTTP Server.
-      --http-tls-config=""       [EXPERIMENTAL] Path to the configuration file
+      --http.config=""           [EXPERIMENTAL] Path to the configuration file
                                  that can enable TLS or authentication for all
                                  HTTP endpoints.
       --labels.default-time-range=24h
diff --git a/docs/components/query.md b/docs/components/query.md
index 3e70054791..5144ebaa67 100644
--- a/docs/components/query.md
+++ b/docs/components/query.md
@@ -323,7 +323,7 @@ Flags:
                                  Listen host:port for HTTP endpoints.
       --http-grace-period=2m     Time to wait after an interrupt received for
                                  HTTP Server.
-      --http-tls-config=""       [EXPERIMENTAL] Path to the configuration file
+      --http.config=""           [EXPERIMENTAL] Path to the configuration file
                                  that can enable TLS or authentication for all
                                  HTTP endpoints.
       --log.format=logfmt        Log format to use. Possible options: logfmt or
diff --git a/docs/components/receive.md b/docs/components/receive.md
index 4ffe4a4625..7b1fe505ef 100644
--- a/docs/components/receive.md
+++ b/docs/components/receive.md
@@ -101,7 +101,7 @@ Flags:
                                  Listen host:port for HTTP endpoints.
       --http-grace-period=2m     Time to wait after an interrupt received for
                                  HTTP Server.
-      --http-tls-config=""       [EXPERIMENTAL] Path to the configuration file
+      --http.config=""           [EXPERIMENTAL] Path to the configuration file
                                  that can enable TLS or authentication for all
                                  HTTP endpoints.
       --label=key="value" ...    External labels to announce. This flag will be
diff --git a/docs/components/rule.md b/docs/components/rule.md
index dae67389f5..cf40e37b7c 100644
--- a/docs/components/rule.md
+++ b/docs/components/rule.md
@@ -311,7 +311,7 @@ Flags:
                                  Listen host:port for HTTP endpoints.
       --http-grace-period=2m     Time to wait after an interrupt received for
                                  HTTP Server.
-      --http-tls-config=""       [EXPERIMENTAL] Path to the configuration file
+      --http.config=""           [EXPERIMENTAL] Path to the configuration file
                                  that can enable TLS or authentication for all
                                  HTTP endpoints.
       --label=<name>="<value>" ...
diff --git a/docs/components/sidecar.md b/docs/components/sidecar.md
index 1379d7f2e2..a33bcfc6db 100644
--- a/docs/components/sidecar.md
+++ b/docs/components/sidecar.md
@@ -108,7 +108,7 @@ Flags:
                                  Listen host:port for HTTP endpoints.
       --http-grace-period=2m     Time to wait after an interrupt received for
                                  HTTP Server.
-      --http-tls-config=""       [EXPERIMENTAL] Path to the configuration file
+      --http.config=""           [EXPERIMENTAL] Path to the configuration file
                                  that can enable TLS or authentication for all
                                  HTTP endpoints.
       --log.format=logfmt        Log format to use. Possible options: logfmt or
diff --git a/docs/components/store.md b/docs/components/store.md
index e71f92c313..b654cce2e3 100644
--- a/docs/components/store.md
+++ b/docs/components/store.md
@@ -75,7 +75,7 @@ Flags:
                                  Listen host:port for HTTP endpoints.
       --http-grace-period=2m     Time to wait after an interrupt received for
                                  HTTP Server.
-      --http-tls-config=""       [EXPERIMENTAL] Path to the configuration file
+      --http.config=""           [EXPERIMENTAL] Path to the configuration file
                                  that can enable TLS or authentication for all
                                  HTTP endpoints.
       --ignore-deletion-marks-delay=24h
diff --git a/docs/components/tools.md b/docs/components/tools.md
index 4e61a0500e..2d66d89607 100644
--- a/docs/components/tools.md
+++ b/docs/components/tools.md
@@ -218,7 +218,7 @@ Flags:
                                 Listen host:port for HTTP endpoints.
       --http-grace-period=2m    Time to wait after an interrupt received for
                                 HTTP Server.
-      --http-tls-config=""      [EXPERIMENTAL] Path to the configuration file
+      --http.config=""          [EXPERIMENTAL] Path to the configuration file
                                 that can enable TLS or authentication for all
                                 HTTP endpoints.
       --label=LABEL             Prometheus label to use as timeline title
@@ -488,7 +488,7 @@ Flags:
                                  Listen host:port for HTTP endpoints.
       --http-grace-period=2m     Time to wait after an interrupt received for
                                  HTTP Server.
-      --http-tls-config=""       [EXPERIMENTAL] Path to the configuration file
+      --http.config=""           [EXPERIMENTAL] Path to the configuration file
                                  that can enable TLS or authentication for all
                                  HTTP endpoints.
       --id=ID ...                Block to be replicated to the destination
@@ -595,7 +595,7 @@ Flags:
                               Listen host:port for HTTP endpoints.
       --http-grace-period=2m  Time to wait after an interrupt received for HTTP
                               Server.
-      --http-tls-config=""    [EXPERIMENTAL] Path to the configuration file that
+      --http.config=""        [EXPERIMENTAL] Path to the configuration file that
                               can enable TLS or authentication for all HTTP
                               endpoints.
       --log.format=logfmt     Log format to use. Possible options: logfmt or
diff --git a/docs/operating/https.md b/docs/operating/https.md
index dfa70d0276..74b1dbac92 100644
--- a/docs/operating/https.md
+++ b/docs/operating/https.md
@@ -8,7 +8,7 @@ menu: operating
 
 Thanos supports basic authentication and TLS. This is **experimental** and might change in the future.
 
-To specify which HTTP TLS configuration file to load, use the `--http-tls-config` flag.
+To specify which HTTP TLS configuration file to load, use the `--http.config` flag.
 The file is written in [YAML format](https://en.wikipedia.org/wiki/YAML), defined by the scheme described below.
 
 ## Scheme
diff --git a/pkg/extkingpin/flags.go b/pkg/extkingpin/flags.go
index 570e5eda28..0a5bd1a8ba 100644
--- a/pkg/extkingpin/flags.go
+++ b/pkg/extkingpin/flags.go
@@ -47,7 +47,7 @@ func RegisterHTTPFlags(cmd FlagClause) (httpBindAddr *string, httpGracePeriod *m
 	httpBindAddr = cmd.Flag("http-address", "Listen host:port for HTTP endpoints.").Default("0.0.0.0:10902").String()
 	httpGracePeriod = ModelDuration(cmd.Flag("http-grace-period", "Time to wait after an interrupt received for HTTP Server.").Default("2m")) // by default it's the same as query.timeout.
 	httpTLSConfig = cmd.Flag(
-		"http-tls-config",
+		"http.config",
 		"[EXPERIMENTAL] Path to the configuration file that can enable TLS or authentication for all HTTP endpoints.",
 	).Default("").String()
 	return httpBindAddr, httpGracePeriod, httpTLSConfig