diff --git a/go/vt/dbconfigs/credentials.go b/go/vt/dbconfigs/credentials.go
index 4e0e5518869..f7082738c5e 100644
--- a/go/vt/dbconfigs/credentials.go
+++ b/go/vt/dbconfigs/credentials.go
@@ -133,6 +133,12 @@ func GetCredentialsServer() CredentialsServer {
 	return cs
 }
 
+// SetDbCredentialsFilePath sets the value of the `--db-credentials-file` flag.
+// This should be used only for testing.
+func SetDbCredentialsFilePath(path string) {
+	dbCredentialsFile = path
+}
+
 // FileCredentialsServer is a simple implementation of CredentialsServer using
 // a json file. Protected by mu.
 type FileCredentialsServer struct {
diff --git a/go/vt/vttablet/tabletserver/tabletenv/config.go b/go/vt/vttablet/tabletserver/tabletenv/config.go
index 1973290e54f..2b99ec44103 100644
--- a/go/vt/vttablet/tabletserver/tabletenv/config.go
+++ b/go/vt/vttablet/tabletserver/tabletenv/config.go
@@ -895,7 +895,12 @@ func (c *TabletConfig) verifyUnmanagedTabletConfig() error {
 		return errors.New("database app user not specified")
 	}
 	if c.DB.App.Password == "" {
-		return errors.New("database app user password not specified")
+		_, pass, err := dbconfigs.GetCredentialsServer().GetUserAndPassword(c.DB.App.User)
+		if err == nil && pass != "" {
+			c.DB.App.Password = pass
+		} else {
+			return errors.New("database app user password not specified")
+		}
 	}
 	// Replication fixes should be disabled for Unmanaged tablets.
 	mysqlctl.DisableActiveReparents = true
diff --git a/go/vt/vttablet/tabletserver/tabletenv/config_test.go b/go/vt/vttablet/tabletserver/tabletenv/config_test.go
index d16b6276964..29c74caa6dd 100644
--- a/go/vt/vttablet/tabletserver/tabletenv/config_test.go
+++ b/go/vt/vttablet/tabletserver/tabletenv/config_test.go
@@ -484,4 +484,12 @@ func TestVerifyUnmanagedTabletConfig(t *testing.T) {
 	config.DB.App.Password = "testPassword"
 	err = config.verifyUnmanagedTabletConfig()
 	assert.Nil(t, err)
+
+	dbconfigs.SetDbCredentialsFilePath("./data/db_credentials.json")
+	defer dbconfigs.SetDbCredentialsFilePath("")
+	config.DB.App.Password = ""
+
+	err = config.verifyUnmanagedTabletConfig()
+	assert.Nil(t, err)
+	assert.Equal(t, "testPassword", config.DB.App.Password)
 }
diff --git a/go/vt/vttablet/tabletserver/tabletenv/data/db_credentials.json b/go/vt/vttablet/tabletserver/tabletenv/data/db_credentials.json
new file mode 100644
index 00000000000..a4c2bfecbd7
--- /dev/null
+++ b/go/vt/vttablet/tabletserver/tabletenv/data/db_credentials.json
@@ -0,0 +1,3 @@
+{
+  "testUser": ["testPassword"]
+}
\ No newline at end of file