diff --git a/e b/e
index 456398aca8de8..af339e72670c2 160000
--- a/e
+++ b/e
@@ -1 +1 @@
-Subproject commit 456398aca8de86fb1bd64717bb4dfb21807681fd
+Subproject commit af339e72670c298ffe4162b9595f96e076c68b7f
diff --git a/lib/client/weblogin.go b/lib/client/weblogin.go
index ca3d60eac3442..e8bb05e256a96 100644
--- a/lib/client/weblogin.go
+++ b/lib/client/weblogin.go
@@ -658,7 +658,8 @@ func SSHAgentMFALogin(ctx context.Context, login SSHLoginMFA) (*authclient.SSHLo
 
 	promptMFA := login.PromptMFA
 	if promptMFA == nil {
-		promptMFA = libmfa.NewCLIPrompt(libmfa.NewPromptConfig(login.ProxyAddr), os.Stderr)
+		cfg := libmfa.NewPromptConfig(login.ProxyAddr)
+		promptMFA = libmfa.NewCLIPrompt(&libmfa.CLIPromptConfig{PromptConfig: *cfg})
 	}
 
 	respPB, err := promptMFA.Run(ctx, chal)
@@ -856,7 +857,8 @@ func SSHAgentMFAWebSessionLogin(ctx context.Context, login SSHLoginMFA) (*WebCli
 
 	promptMFA := login.PromptMFA
 	if promptMFA == nil {
-		promptMFA = libmfa.NewCLIPrompt(libmfa.NewPromptConfig(login.ProxyAddr), os.Stderr)
+		cfg := libmfa.NewPromptConfig(login.ProxyAddr)
+		promptMFA = libmfa.NewCLIPrompt(&libmfa.CLIPromptConfig{PromptConfig: *cfg})
 	}
 
 	respPB, err := promptMFA.Run(ctx, chal)