diff --git a/src/apphosting/index.ts b/src/apphosting/index.ts
index faba4ab5181..231a42db85d 100644
--- a/src/apphosting/index.ts
+++ b/src/apphosting/index.ts
@@ -408,7 +408,10 @@ export async function deleteBackendAndPoll(
 /**
  * Prompts the user for a location.
  */
-export async function promptLocation(projectId: string, prompt: string): Promise<string> {
+export async function promptLocation(
+  projectId: string,
+  prompt: string = "Please select a location:",
+): Promise<string> {
   const allowedLocations = (await apphosting.listLocations(projectId)).map((loc) => loc.locationId);
 
   return (await promptOnce({
diff --git a/src/commands/apphosting-secrets-grantaccess.ts b/src/commands/apphosting-secrets-grantaccess.ts
index 5645378c081..a99da896620 100644
--- a/src/commands/apphosting-secrets-grantaccess.ts
+++ b/src/commands/apphosting-secrets-grantaccess.ts
@@ -7,11 +7,11 @@ import * as secretManager from "../gcp/secretManager";
 import { requirePermissions } from "../requirePermissions";
 import * as apphosting from "../gcp/apphosting";
 import * as secrets from "../apphosting/secrets";
-import { promptLocation } from "../apphosting";
+import { getBackendForAmbiguousLocation } from "../apphosting";
 
 export const command = new Command("apphosting:secrets:grantaccess <secretName>")
   .description("grant service accounts permissions to the provided secret")
-  .option("-l, --location <location>", "backend location")
+  .option("-l, --location <location>", "backend location", "-")
   .option("-b, --backend <backend>", "backend name")
   .before(requireAuth)
   .before(secretManager.ensureApi)
@@ -34,20 +34,24 @@ export const command = new Command("apphosting:secrets:grantaccess <secretName>"
       );
     }
 
-    let location = options.location as string;
-
-    location =
-      location || (await promptLocation(projectId, "Please select the location of your backend"));
-
-    // TODO: consider showing dialog if --backend is missing
-
     const exists = await secretManager.secretExists(projectId, secretName);
     if (!exists) {
       throw new FirebaseError(`Cannot find secret ${secretName}`);
     }
 
     const backendId = options.backend as string;
-    const backend = await apphosting.getBackend(projectId, location, backendId);
+    const location = options.location as string;
+    let backend: apphosting.Backend;
+    if (location === "" || location === "-") {
+      backend = await getBackendForAmbiguousLocation(
+        projectId,
+        backendId,
+        "Please select the location of your backend:",
+      );
+    } else {
+      backend = await apphosting.getBackend(projectId, location, backendId);
+    }
+
     const accounts = secrets.toMulti(secrets.serviceAccountsForBackend(projectNumber, backend));
 
     await secrets.grantSecretAccess(projectId, projectNumber, secretName, accounts);
diff --git a/src/test/apphosting/index.spec.ts b/src/test/apphosting/index.spec.ts
index 2308859549a..ff5a79968c2 100644
--- a/src/test/apphosting/index.spec.ts
+++ b/src/test/apphosting/index.spec.ts
@@ -227,7 +227,7 @@ describe("apphosting setup functions", () => {
     });
 
     it("returns a location selection", async () => {
-      const location = await promptLocation(projectId);
+      const location = await promptLocation(projectId, /* prompt= */ "");
       expect(location).to.be.eq("us-central1");
     });
 
@@ -302,7 +302,11 @@ describe("apphosting setup functions", () => {
       promptOnceStub.resolves(location);
 
       await expect(
-        getBackendForAmbiguousLocation(projectId, "foo", /* prompt= */ ""),
+        getBackendForAmbiguousLocation(
+          projectId,
+          "foo",
+          "Please select the location of the backend you'd like to delete:",
+        ),
       ).to.eventually.equal(backendFoo);
 
       expect(promptOnceStub).to.be.calledWith({