diff --git a/ccid/README b/ccid/README
index 2e95533..cb89d0b 100644
--- a/ccid/README
+++ b/ccid/README
@@ -55,11 +55,14 @@ USAGE
 
 When testing PACE with either PIN, CAN, MRZ or PUK run pace-tool. Here you can
 enter APDUs which are to be converted according to the secure messaging
-parameter and to be sent to the card. Herefor insert the APDU in hex with a
-colon to separate the bytes or without it. So to read the current selected file
-both of these forms would be valid:
+parameter and to be sent to the card. Herefor insert the APDU in hex (upper or
+lower case) with a colon to separate the bytes or without it. So to read the
+current selected file both of these forms would be valid:
 00:b0:02:00:00
 00B0020000
+To pass a secret to pace-tool, the command line parameters or the environment
+variables PIN/CAN/MRZ/PUK/NEWPIN can be used. If none of these options is used,
+pace-tool will show a password prompt.
 
 
 QUESTIONS
diff --git a/ccid/src/pace-tool.c b/ccid/src/pace-tool.c
index c650baf..47b5dd6 100644
--- a/ccid/src/pace-tool.c
+++ b/ccid/src/pace-tool.c
@@ -244,6 +244,8 @@ main (int argc, char **argv)
             case OPT_CHANGE_PIN:
                 dochangepin = 1;
                 newpin = optarg;
+                if (!newpin)
+                    pin = getenv("NEWPIN");
                 break;
             case OPT_RESUME_PIN:
                 doresumepin = 1;
@@ -352,7 +354,8 @@ main (int argc, char **argv)
             id = PACE_PUK;
             s = puk;
         } else {
-            fprintf(stderr, "Please provide PIN, CAN, MRZ or PUK.");
+            fprintf(stderr, "Please specify whether to do PACE with "
+                    "PIN, CAN, MRZ or PUK.");
             exit(1);
         }