diff --git a/src/__celerity_resource_map__.php b/src/__celerity_resource_map__.php
index 213bfa4f02..b1d3ef33e2 100644
--- a/src/__celerity_resource_map__.php
+++ b/src/__celerity_resource_map__.php
@@ -1982,7 +1982,7 @@ celerity_register_resource_map(array(
   ),
   'javelin-behavior-passphrase-credential-control' =>
   array(
-    'uri' => '/res/e606ad52/rsrc/js/application/passphrase/phame-credential-control.js',
+    'uri' => '/res/70823662/rsrc/js/application/passphrase/phame-credential-control.js',
     'type' => 'js',
     'requires' =>
     array(
@@ -1991,6 +1991,7 @@ celerity_register_resource_map(array(
       2 => 'javelin-stratcom',
       3 => 'javelin-workflow',
       4 => 'javelin-util',
+      5 => 'javelin-uri',
     ),
     'disk' => '/rsrc/js/application/passphrase/phame-credential-control.js',
   ),
diff --git a/src/applications/passphrase/controller/PassphraseCredentialEditController.php b/src/applications/passphrase/controller/PassphraseCredentialEditController.php
index 52206225d7..f48b45e652 100644
--- a/src/applications/passphrase/controller/PassphraseCredentialEditController.php
+++ b/src/applications/passphrase/controller/PassphraseCredentialEditController.php
@@ -45,6 +45,9 @@ final class PassphraseCredentialEditController extends PassphraseController {
         ->setProvidesType($type->getProvidesType());
 
       $is_new = true;
+
+      // Prefill username if provided.
+      $credential->setUsername($request->getStr('username'));
     }
 
     $errors = array();
diff --git a/src/applications/passphrase/view/PassphraseCredentialControl.php b/src/applications/passphrase/view/PassphraseCredentialControl.php
index fd07e5df06..8ba1659481 100644
--- a/src/applications/passphrase/view/PassphraseCredentialControl.php
+++ b/src/applications/passphrase/view/PassphraseCredentialControl.php
@@ -4,6 +4,18 @@ final class PassphraseCredentialControl extends AphrontFormControl {
 
   private $options;
   private $credentialType;
+  private $defaultUsername;
+  private $allowNull;
+
+  public function setAllowNull($allow_null) {
+    $this->allowNull = $allow_null;
+    return $this;
+  }
+
+  public function setDefaultUsername($default_username) {
+    $this->defaultUsername = $default_username;
+    return $this;
+  }
 
   public function setCredentialType($credential_type) {
     $this->credentialType = $credential_type;
@@ -35,9 +47,13 @@ final class PassphraseCredentialControl extends AphrontFormControl {
     }
 
     $disabled = $this->getDisabled();
-    if (!$options_map) {
-      $options_map[''] = pht('(No Existing Credentials)');
-      $disabled = true;
+    if ($this->allowNull) {
+      $options_map = array('' => pht('(No Credentials)')) + $options_map;
+    } else {
+      if (!$options_map) {
+        $options_map[''] = pht('(No Existing Credentials)');
+        $disabled = true;
+      }
     }
 
     Javelin::initBehavior('passphrase-credential-control');
@@ -68,6 +84,8 @@ final class PassphraseCredentialControl extends AphrontFormControl {
         'sigil' => 'passphrase-credential-control',
         'meta' => array(
           'type' => $this->getCredentialType(),
+          'username' => $this->defaultUsername,
+          'allowNull' => $this->allowNull,
         ),
       ),
       array(
diff --git a/webroot/rsrc/js/application/passphrase/phame-credential-control.js b/webroot/rsrc/js/application/passphrase/phame-credential-control.js
index 42c2d90fd9..6dd20fbd2c 100644
--- a/webroot/rsrc/js/application/passphrase/phame-credential-control.js
+++ b/webroot/rsrc/js/application/passphrase/phame-credential-control.js
@@ -5,6 +5,8 @@
  *           javelin-stratcom
  *           javelin-workflow
  *           javelin-util
+ *           javelin-uri
+ * @javelin
  */
 
 JX.behavior('passphrase-credential-control', function(config) {
@@ -16,7 +18,11 @@ JX.behavior('passphrase-credential-control', function(config) {
       var control = e.getNode('passphrase-credential-control');
       var data = e.getNodeData('passphrase-credential-control');
 
-      new JX.Workflow('/passphrase/edit/?type=' + data.type)
+      var uri = JX.$U('/passphrase/edit/');
+      uri.setQueryParam('type', data.type);
+      uri.setQueryParam('username', data.username);
+
+      new JX.Workflow(uri)
         .setHandler(JX.bind(null, onadd, control))
         .start();
 
@@ -26,16 +32,29 @@ JX.behavior('passphrase-credential-control', function(config) {
   function onadd(control, response) {
     var select = JX.DOM.find(control, 'select', 'passphrase-credential-select');
 
+    var data = JX.Stratcom.getData(control);
+
+    // If this allows the user to select "No Credential" (`allowNull`),
+    // put the new credential in the menu below the "No Credential" option.
+
+    // Otherwise, remove the "(No Existing Credentials)" if it exists and
+    // put the new credential at the top.
+
+    var target = 0;
     for (var ii = 0; ii < select.options.length; ii++) {
       if (!select.options[ii].value) {
-        select.remove(ii);
+        if (!data.allowNull) {
+          select.remove(ii);
+        } else {
+          target = ii + 1;
+        }
         break;
       }
     }
 
     select.add(
       JX.$N('option', {value: response.phid}, response.name),
-      select.options[0] || null);
+      select.options[target] || null);
 
     select.value = response.phid;
     select.disabled = null;