diff --git a/tools/test/bin/onos-secure-ssh b/tools/test/bin/onos-secure-ssh
index 6d898ee..6109f7b 100755
--- a/tools/test/bin/onos-secure-ssh
+++ b/tools/test/bin/onos-secure-ssh
@@ -6,7 +6,18 @@
 [ ! -d "$ONOS_ROOT" ] && echo "ONOS_ROOT is not defined" >&2 && exit 1
 . $ONOS_ROOT/tools/build/envDefaults
 
-nodes=$(env | sort | egrep "OC[0-9]+" | cut -d= -f2)
+# Scan arguments for user/password or other options...
+while getopts u:p: o; do
+    case "$o" in
+        u) user=$OPTARG;;
+        p) password=$OPTARG;;
+    esac
+done
+password=${password:-$user} # password defaults to the user if not specified
+let OPC=$OPTIND-1
+shift $OPC
+
+nodes=${1:-$(env | sort | egrep "OC[0-9]+" | cut -d= -f2)}
 
 for node in $nodes; do
     # Prune the node entry from the known hosts file since server key changes
@@ -17,7 +28,7 @@
     ssh $ONOS_USER@$node "
         [ ! -f ~/.ssh/id_rsa.pub ] && ssh-keygen -t rsa -f ~/.ssh/id_rsa -P '' -q
         $ONOS_INSTALL_DIR/bin/onos-user-key \$(id -un) \$(cut -d\\  -f2 ~/.ssh/id_rsa.pub)
-        $ONOS_INSTALL_DIR/bin/onos-secure-ssh "$@"
+        $ONOS_INSTALL_DIR/bin/onos-secure-ssh -u $user -p $password
 
         # Implicitly accept the new server key in dev/test environments
         while ! ssh -p 8101 -o StrictHostKeyChecking=no localhost list 2>/dev/null; do
diff --git a/tools/test/scenarios/setup.xml b/tools/test/scenarios/setup.xml
index 10f6ba6..9e992f5 100644
--- a/tools/test/scenarios/setup.xml
+++ b/tools/test/scenarios/setup.xml
@@ -16,7 +16,6 @@
 <scenario name="setup" description="ONOS cluster setup">
     <group name="Setup">
         <step name="Push-Bits" exec="onos-push-bits-through-proxy" if="${OCT}"/>
-        <step name="Secure-SSH" exec="onos-secure-ssh -u ${ONOS_WEB_USER} -p ${ONOS_WEB_PASS}" if="${ONOS_USE_SSH}"/>
         <step name="Enable-Flow-Objective-Intents" if="${ONOS_USE_FOI}"
               exec="onos ${OC1} cfg set org.onosproject.net.intent.impl.compiler.IntentConfigurableRegistrator useFlowObjectives true"/>
 
@@ -30,10 +29,12 @@
             <step name="Install-${#}" exec="onos-install ${OC#}"
                   requires="Kill-${#},Push-Bits-${#},Push-Bits"/>
 
-            <dependency name="Secure-SSH" requires="Install-${#}"/>
+            <step name="Secure-SSH-${#}" requires="Install-${#}"
+                  exec="onos-secure-ssh -u ${ONOS_WEB_USER} -p ${ONOS_WEB_PASS} ${OC#}"
+                  if="${ONOS_USE_SSH}"/>
 
             <step name="Wait-for-Start-${#}" exec="onos-wait-for-start ${OC#}"
-                  requires="Install-${#},~Secure-SSH"/>
+                  requires="Install-${#},~Secure-SSH-${#}"/>
 
             <step name="Check-Nodes-${#}" exec="onos-check-nodes ${OC#}" delay="3"
                   requires="~Wait-for-Start-${#}"/>