diff --git a/pkg/config/cluster.go b/pkg/config/cluster.go
index dce7179f..f4d36b78 100644
--- a/pkg/config/cluster.go
+++ b/pkg/config/cluster.go
@@ -218,9 +218,12 @@ func (c ClusterConfig) NewAdminClient(
 		var saslUsername string
 		var saslPassword string
 		var secretsManagerArn string
+
+		overridingUserPass := false
 		if opts.UsernameOverride != "" {
 			log.Debugf("Setting SASL username from override value")
 			saslUsername = opts.UsernameOverride
+			overridingUserPass = true
 		} else {
 			saslUsername = c.Spec.SASL.Username
 		}
@@ -228,6 +231,7 @@ func (c ClusterConfig) NewAdminClient(
 		if opts.PasswordOverride != "" {
 			log.Debugf("Setting SASL password from override value")
 			saslPassword = opts.PasswordOverride
+			overridingUserPass = true
 		} else {
 			saslPassword = c.Spec.SASL.Password
 		}
@@ -238,6 +242,15 @@ func (c ClusterConfig) NewAdminClient(
 		} else {
 			secretsManagerArn = c.Spec.SASL.SecretsManagerArn
 		}
+		if overridingUserPass {
+			// Make sure both user and pass were provided
+			if saslUsername == "" || saslPassword == "" {
+				return nil, errors.New("Both username and password are required when overriding config")
+			} else {
+				log.Warn("Username/Password override takes precedence over SecretsManagerArn")
+				secretsManagerArn = ""
+			}
+		}
 
 		var saslMechanism admin.SASLMechanism
 		var err error
diff --git a/pkg/version/version.go b/pkg/version/version.go
index 6e4007cd..22f2b386 100644
--- a/pkg/version/version.go
+++ b/pkg/version/version.go
@@ -1,4 +1,4 @@
 package version
 
 // Version is the current topicctl version.
-const Version = "1.19.1"
+const Version = "1.19.2"