diff --git a/rage/Cargo.toml b/rage/Cargo.toml
index 6ea0c45..76389d5 100644
--- a/rage/Cargo.toml
+++ b/rage/Cargo.toml
@@ -56,7 +56,7 @@ maintenance = { status = "experimental" }
 # rage and rage-keygen dependencies
 age = { workspace = true, features = ["armor", "cli-common", "plugin"] }
 chrono.workspace = true
-clap.workspace = true
+clap = { workspace = true, features = ["string", "unstable-styles"] }
 console.workspace = true
 env_logger.workspace = true
 i18n-embed = { workspace = true, features = ["desktop-requester"] }
diff --git a/rage/i18n/en-US/rage.ftl b/rage/i18n/en-US/rage.ftl
index db4ef49..0495201 100644
--- a/rage/i18n/en-US/rage.ftl
+++ b/rage/i18n/en-US/rage.ftl
@@ -9,6 +9,7 @@
 ### Localization for strings in the rage CLI tools
 
 -age = age
+-age-plugin- = age-plugin-
 -rage = rage
 
 ## CLI flags
@@ -27,25 +28,45 @@
 
 ## Usage
 
--input = INPUT
--output = OUTPUT
--identity = IDENTITY
--recipient = RECIPIENT
--recipients-file = PATH
+usage-header = Usage
 
-usage-header = Usage:
+recipient = RECIPIENT
+recipients-file = PATH
+identity = IDENTITY
+plugin-name = PLUGIN-NAME
+input = INPUT
+output = OUTPUT
+
+args-header = Arguments
+
+help-arg-input = Path to a file to read from.
+
+flags-header = Options
+
+help-flag-help = Print this help message and exit.
+help-flag-version = Print version info and exit.
+help-flag-encrypt = Encrypt the input (the default).
+help-flag-decrypt = Decrypt the input.
+help-flag-passphrase = Encrypt with a passphrase instead of recipients.
+help-flag-max-work-factor = Maximum work factor to allow for passphrase decryption.
+help-flag-armor = Encrypt to a PEM encoded format.
+help-flag-recipient = Encrypt to the specified {recipient}. May be repeated.
+help-flag-recipients-file = Encrypt to the recipients listed at {recipients-file}. May be repeated.
+help-flag-identity = Use the identity file at {identity}. May be repeated.
+help-flag-plugin-name = Use {-age-plugin-}{plugin-name} in its default mode as an identity.
+help-flag-output = Write the result to the file at path {output}.
 
 rage-after-help =
-    {-input} defaults to standard input, and {-output} defaults to standard output.
+    {input} defaults to standard input, and {output} defaults to standard output.
 
-    {-recipient} can be:
+    {recipient} can be:
     - An {-age} public key, as generated by {$keygen_name} ("age1...").
     - An SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
 
-    {-recipients-file} is a path to a file containing {-age} recipients, one per line
+    {recipients-file} is a path to a file containing {-age} recipients, one per line
     (ignoring "#" prefixed comments and empty lines).
 
-    {-identity} is a path to a file with {-age} identities, one per line
+    {identity} is a path to a file with {-age} identities, one per line
     (ignoring "#" prefixed comments and empty lines), or to an SSH key file.
     Passphrase-encrypted {-age} identity files can be used as identity files.
     Multiple identities may be provided, and any unused ones will be ignored.
@@ -56,6 +77,8 @@ rage-after-help =
     {"  "}{$example_b}
     {"  "}{$example_c}
 
+keygen-help-flag-output = {help-flag-output} Defaults to standard output.
+
 ## Formatting
 
 warning-msg = Warning: {$warning}
@@ -155,6 +178,14 @@ rec-dec-recipient-flag = Did you mean to use {-flag-identity} to specify a priva
 
 -flag-mnt-types = -t/--types
 
+mnt-filename = FILENAME
+mnt-mountpoint = MOUNTPOINT
+mnt-types = TYPES
+
+help-arg-mnt-filename = The encrypted filesystem to mount.
+help-arg-mnt-mountpoint = The directory to mount the filesystem at.
+help-arg-mnt-types = Indicates the filesystem type (one of {$types}).
+
 info-decrypting = Decrypting {$filename}
 info-mounting-as-fuse = Mounting as FUSE filesystem
 
diff --git a/rage/i18n/es-AR/rage.ftl b/rage/i18n/es-AR/rage.ftl
index 45df2d1..fec5a5d 100644
--- a/rage/i18n/es-AR/rage.ftl
+++ b/rage/i18n/es-AR/rage.ftl
@@ -9,6 +9,7 @@
 ### Localization for strings in the rage CLI tools
 
 -age = age
+-age-plugin- = age-plugin-
 -rage = rage
 
 ## CLI flags
@@ -27,25 +28,26 @@
 
 ## Usage
 
--input = INPUT
--output = OUTPUT
--identity = IDENTITY
--recipient = RECIPIENT
--recipients-file = PATH
+usage-header = Usage
 
-usage-header = Usage:
+recipient = RECIPIENT
+recipients-file = PATH
+identity = IDENTITY
+plugin-name = PLUGIN-NAME
+input = INPUT
+output = OUTPUT
 
 rage-after-help =
-    {-input} por defecto a standard input, y {-output} por defecto standard output.
+    {input} por defecto a standard input, y {output} por defecto standard output.
 
-    {-recipient} puede ser:
+    {recipient} puede ser:
     - Una clave pública {-age}, como es generada por {$keygen_name} ("age1...").
     - Una clave pública SSH ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
 
-    {-recipients-file} es una ruta a un archivo que contenga un destinatario {-age} por línea
+    {recipients-file} es una ruta a un archivo que contenga un destinatario {-age} por línea
     (ignorando comentarios con el prefijo "#" y líneas vacías).
 
-    {-identity} es una ruta a una archivo con una identidad {-age} por línea
+    {identity} es una ruta a una archivo con una identidad {-age} por línea
     (ignorando comentarios con el prefijo "#" y líneas vacías), o a un archivo
     de claves SSH.
     Passphrase-encrypted {-age} identity files can be used as identity files.
diff --git a/rage/i18n/it/rage.ftl b/rage/i18n/it/rage.ftl
index c146cbf..da7305c 100644
--- a/rage/i18n/it/rage.ftl
+++ b/rage/i18n/it/rage.ftl
@@ -9,6 +9,7 @@
 ### Localization for strings in the rage CLI tools
 
 -age = age
+-age-plugin- = age-plugin-
 -rage = rage
 
 ## CLI flags
@@ -27,26 +28,27 @@
 
 ## Usage
 
--input = INPUT
--output = OUTPUT
--identity = IDENTITY
--recipient = RECIPIENT
--recipients-file = PATH
+usage-header = Usage
 
-usage-header = Usage:
+recipient = RECIPIENT
+recipients-file = PATH
+identity = IDENTITY
+plugin-name = PLUGIN-NAME
+input = INPUT
+output = OUTPUT
 
 rage-after-help =
-    {-input} ha come valore predefinito lo standard input, e {-output} ha come
+    {input} ha come valore predefinito lo standard input, e {output} ha come
     valore predefinito lo standard output.
 
-    {-recipient} può essere:
+    {recipient} può essere:
     - Una chiave pubblica {-age}, come generata da {$keygen_name} ("age1...").
     - Una chiave pubblica SSH ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
 
-    {-recipients-file} è il percorso ad un file contenente dei destinatari {-age},
+    {recipients-file} è il percorso ad un file contenente dei destinatari {-age},
     uno per riga (ignorando i commenti che iniziano con "#" e le righe vuote).
 
-    {-identity} è il percorso ad un file contenente identità {-age}, una per
+    {identity} è il percorso ad un file contenente identità {-age}, una per
     riga (ignorando i commenti che iniziano con "#" e le righe vuote), o ad un
     file contenente una chiave SSH.
     I file di identità possono essere cifrati con {-age} e una passphrase.
diff --git a/rage/i18n/zh-CN/rage.ftl b/rage/i18n/zh-CN/rage.ftl
index 4fe28b0..558b4c2 100644
--- a/rage/i18n/zh-CN/rage.ftl
+++ b/rage/i18n/zh-CN/rage.ftl
@@ -9,6 +9,7 @@
 ### Localization for strings in the rage CLI tools
 
 -age = age
+-age-plugin- = age-plugin-
 -rage = rage
 
 ## CLI flags
@@ -27,25 +28,26 @@
 
 ## Usage
 
--input = INPUT
--output = OUTPUT
--identity = IDENTITY
--recipient = RECIPIENT
--recipients-file = PATH
+usage-header = Usage
 
-usage-header = Usage:
+recipient = RECIPIENT
+recipients-file = PATH
+identity = IDENTITY
+plugin-name = PLUGIN-NAME
+input = INPUT
+output = OUTPUT
 
 rage-after-help =
-    {-input} 默认为标准输入 （stdin）, 而 {-output} 默认为标准输出 （stdout） 。
+    {input} 默认为标准输入 （stdin）, 而 {output} 默认为标准输出 （stdout） 。
 
-    {-recipient} 可为：
+    {recipient} 可为：
     - 一把以 {$keygen_name} 生成的 {-age} 公钥 ("age1...")。
     - 一把 SSH 公钥 ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...")。
 
-    {-recipients-file} 是一个文件路径。该文件应含有 {-age} 接收方, 每行一个
+    {recipients-file} 是一个文件路径。该文件应含有 {-age} 接收方, 每行一个
     （前缀为 "#" 的注释以及空行将被忽略）。
 
-    {-identity} 是一个文件路径。该文件或含 {-age} 身份, 每行一个（前缀为 "#" 的注释以及空行将被忽略），
+    {identity} 是一个文件路径。该文件或含 {-age} 身份, 每行一个（前缀为 "#" 的注释以及空行将被忽略），
     亦或为 SSH 密钥文件。
     Passphrase-encrypted {-age} identity files can be used as identity files.
     您可提供多份身份, 未使用的身份将被忽略。
diff --git a/rage/i18n/zh-TW/rage.ftl b/rage/i18n/zh-TW/rage.ftl
index 733ca15..72206a6 100644
--- a/rage/i18n/zh-TW/rage.ftl
+++ b/rage/i18n/zh-TW/rage.ftl
@@ -9,6 +9,7 @@
 ### Localization for strings in the rage CLI tools
 
 -age = age
+-age-plugin- = age-plugin-
 -rage = rage
 
 ## CLI flags
@@ -27,25 +28,26 @@
 
 ## Usage
 
--input = INPUT
--output = OUTPUT
--identity = IDENTITY
--recipient = RECIPIENT
--recipients-file = PATH
+usage-header = Usage
 
-usage-header = Usage:
+recipient = RECIPIENT
+recipients-file = PATH
+identity = IDENTITY
+plugin-name = PLUGIN-NAME
+input = INPUT
+output = OUTPUT
 
 rage-after-help =
-    {-input} 默認為標準輸入 （stdin）, 而 {-output} 默認為標準輸出 （stdout） 。
+    {input} 默認為標準輸入 （stdin）, 而 {output} 默認為標準輸出 （stdout） 。
 
-    {-recipient} 可為：
+    {recipient} 可為：
     - 一把以 {$keygen_name} 生成的 {-age} 公鑰 ("age1...")。
     - 一把 SSH 公鑰 ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...")。
 
-    {-recipients-file} 是一個文件路徑。該文件應含有 {-age} 接收方, 每行一個
+    {recipients-file} 是一個文件路徑。該文件應含有 {-age} 接收方, 每行一個
     （前綴為 "#" 的注釋以及空行將被忽略）。
 
-    {-identity} 是一個文件路徑。該文件或含 {-age} 身份, 每行一個（前綴為 "#" 的注釋以及空行將被忽略），
+    {identity} 是一個文件路徑。該文件或含 {-age} 身份, 每行一個（前綴為 "#" 的注釋以及空行將被忽略），
     亦或為 SSH 密鑰文件。
     Passphrase-encrypted {-age} identity files can be used as identity files.
     您可提供多份身份, 未使用的身份將被忽略。
diff --git a/rage/src/bin/rage-keygen/main.rs b/rage/src/bin/rage-keygen/main.rs
index 3c577a6..9f7e318 100644
--- a/rage/src/bin/rage-keygen/main.rs
+++ b/rage/src/bin/rage-keygen/main.rs
@@ -1,7 +1,7 @@
 #![forbid(unsafe_code)]
 
 use age::{cli_common::file_io, secrecy::ExposeSecret};
-use clap::{ArgAction, Parser};
+use clap::{builder::Styles, ArgAction, Parser};
 use i18n_embed::{
     fluent::{fluent_language_loader, FluentLanguageLoader},
     DesktopLanguageRequester,
@@ -35,19 +35,30 @@ macro_rules! fl {
 #[command(display_name = "rage-keygen")]
 #[command(name = "rage-keygen")]
 #[command(version)]
+#[command(help_template = format!("\
+{{before-help}}{{about-with-newline}}
+{}{}:{} {{usage}}
+
+{{all-args}}{{after-help}}\
+    ",
+    Styles::default().get_usage().render(),
+    fl!("usage-header"),
+    Styles::default().get_usage().render_reset()))]
+#[command(next_help_heading = fl!("flags-header"))]
 #[command(disable_help_flag(true))]
 #[command(disable_version_flag(true))]
 struct AgeOptions {
     #[arg(action = ArgAction::Help, short, long)]
-    #[arg(help = "Print this help message and exit.")]
+    #[arg(help = fl!("help-flag-help"))]
     help: Option<bool>,
 
     #[arg(action = ArgAction::Version, short = 'V', long)]
-    #[arg(help = "Print version info and exit.")]
+    #[arg(help = fl!("help-flag-version"))]
     version: Option<bool>,
 
     #[arg(short, long)]
-    #[arg(help = "Write the result to the file at path OUTPUT. Defaults to standard output.")]
+    #[arg(value_name = fl!("output"))]
+    #[arg(help = fl!("keygen-help-flag-output"))]
     output: Option<String>,
 }
 
diff --git a/rage/src/bin/rage-mount/main.rs b/rage/src/bin/rage-mount/main.rs
index 746f6ae..6030b8c 100644
--- a/rage/src/bin/rage-mount/main.rs
+++ b/rage/src/bin/rage-mount/main.rs
@@ -5,7 +5,7 @@ use age::{
     cli_common::{read_identities, read_secret},
     stream::StreamReader,
 };
-use clap::{ArgAction, CommandFactory, Parser};
+use clap::{builder::Styles, ArgAction, CommandFactory, Parser};
 use fuse_mt::FilesystemMT;
 use fuser::MountOption;
 use i18n_embed::{
@@ -129,33 +129,49 @@ impl fmt::Debug for Error {
 #[command(display_name = "rage-mount")]
 #[command(name = "rage-mount")]
 #[command(version)]
+#[command(help_template = format!("\
+{{before-help}}{{about-with-newline}}
+{}{}:{} {{usage}}
+
+{{all-args}}{{after-help}}\
+    ",
+    Styles::default().get_usage().render(),
+    fl!("usage-header"),
+    Styles::default().get_usage().render_reset()))]
+#[command(next_help_heading = fl!("flags-header"))]
 #[command(disable_help_flag(true))]
 #[command(disable_version_flag(true))]
 struct AgeMountOptions {
-    #[arg(help = "The encrypted filesystem to mount.")]
+    #[arg(help_heading = fl!("args-header"))]
+    #[arg(value_name = fl!("mnt-filename"))]
+    #[arg(help = fl!("help-arg-mnt-filename"))]
     filename: String,
 
-    #[arg(help = "The directory to mount the filesystem at.")]
+    #[arg(help_heading = fl!("args-header"))]
+    #[arg(value_name = fl!("mnt-mountpoint"))]
+    #[arg(help = fl!("help-arg-mnt-mountpoint"))]
     mountpoint: String,
 
     #[arg(action = ArgAction::Help, short, long)]
-    #[arg(help = "Print this help message and exit.")]
+    #[arg(help = fl!("help-flag-help"))]
     help: Option<bool>,
 
     #[arg(action = ArgAction::Version, short = 'V', long)]
-    #[arg(help = "Print version info and exit.")]
+    #[arg(help = fl!("help-flag-version"))]
     version: Option<bool>,
 
     #[arg(short, long)]
-    #[arg(help = "Indicates the filesystem type (one of \"tar\", \"zip\").")]
+    #[arg(value_name = fl!("mnt-types"))]
+    #[arg(help = fl!("help-arg-mnt-types", types = "\"tar\", \"zip\""))]
     types: String,
 
     #[arg(long, value_name = "WF")]
-    #[arg(help = "Maximum work factor to allow for passphrase decryption.")]
+    #[arg(help = fl!("help-flag-max-work-factor"))]
     max_work_factor: Option<u8>,
 
     #[arg(short, long)]
-    #[arg(help = "Use the private key file at IDENTITY. May be repeated.")]
+    #[arg(value_name = fl!("identity"))]
+    #[arg(help = fl!("help-flag-identity"))]
     identity: Vec<String>,
 }
 
diff --git a/rage/src/bin/rage/main.rs b/rage/src/bin/rage/main.rs
index 1624a79..d2adbeb 100644
--- a/rage/src/bin/rage/main.rs
+++ b/rage/src/bin/rage/main.rs
@@ -9,7 +9,7 @@ use age::{
     secrecy::ExposeSecret,
     Identity, IdentityFile, IdentityFileEntry, Recipient,
 };
-use clap::{ArgAction, CommandFactory, Parser};
+use clap::{builder::Styles, ArgAction, CommandFactory, Parser};
 use i18n_embed::{
     fluent::{fluent_language_loader, FluentLanguageLoader},
     DesktopLanguageRequester,
@@ -247,9 +247,14 @@ fn binary_name() -> String {
 
 fn usage() -> String {
     let binary_name = binary_name();
+    let recipient = fl!("recipient");
+    let identity = fl!("identity");
+    let input = fl!("input");
+    let output = fl!("output");
+
     format!(
-        "{binary_name} [--encrypt] -r RECIPIENT [-i IDENTITY] [-a] [-o OUTPUT] [INPUT]\n       \
-        {binary_name} --decrypt [-i IDENTITY] [-o OUTPUT] [INPUT]",
+        "{binary_name} [--encrypt] -r {recipient} [-i {identity}] [-a] [-o {output}] [{input}]\n       \
+        {binary_name} --decrypt [-i {identity}] [-o {output}] [{input}]",
     )
 }
 
@@ -279,60 +284,77 @@ fn after_help() -> String {
 
 #[derive(Debug, Parser)]
 #[command(version)]
+#[command(help_template = format!("\
+{{before-help}}{{about-with-newline}}
+{}{}:{} {{usage}}
+
+{{all-args}}{{after-help}}\
+    ",
+    Styles::default().get_usage().render(),
+    fl!("usage-header"),
+    Styles::default().get_usage().render_reset()))]
 #[command(override_usage(usage()))]
+#[command(next_help_heading = fl!("flags-header"))]
 #[command(disable_help_flag(true))]
 #[command(disable_version_flag(true))]
 #[command(after_help(after_help()))]
 struct AgeOptions {
-    #[arg(help = "Path to a file to read from.")]
+    #[arg(help_heading = fl!("args-header"))]
+    #[arg(value_name = fl!("input"))]
+    #[arg(help = fl!("help-arg-input"))]
     input: Option<String>,
 
     #[arg(action = ArgAction::Help, short, long)]
-    #[arg(help = "Print this help message and exit.")]
+    #[arg(help = fl!("help-flag-help"))]
     help: Option<bool>,
 
     #[arg(action = ArgAction::Version, short = 'V', long)]
-    #[arg(help = "Print version info and exit.")]
+    #[arg(help = fl!("help-flag-version"))]
     version: Option<bool>,
 
     #[arg(short, long)]
-    #[arg(help = "Encrypt the input (the default).")]
+    #[arg(help = fl!("help-flag-encrypt"))]
     encrypt: bool,
 
     #[arg(short, long)]
-    #[arg(help = "Decrypt the input.")]
+    #[arg(help = fl!("help-flag-decrypt"))]
     decrypt: bool,
 
     #[arg(short, long)]
-    #[arg(help = "Encrypt with a passphrase instead of recipients.")]
+    #[arg(help = fl!("help-flag-passphrase"))]
     passphrase: bool,
 
     #[arg(long, value_name = "WF")]
-    #[arg(help = "Maximum work factor to allow for passphrase decryption.")]
+    #[arg(help = fl!("help-flag-max-work-factor"))]
     max_work_factor: Option<u8>,
 
     #[arg(short, long)]
-    #[arg(help = "Encrypt to a PEM encoded format.")]
+    #[arg(help = fl!("help-flag-armor"))]
     armor: bool,
 
     #[arg(short, long)]
-    #[arg(help = "Encrypt to the specified RECIPIENT. May be repeated.")]
+    #[arg(value_name = fl!("recipient"))]
+    #[arg(help = fl!("help-flag-recipient"))]
     recipient: Vec<String>,
 
-    #[arg(short = 'R', long, value_name = "PATH")]
-    #[arg(help = "Encrypt to the recipients listed at PATH. May be repeated.")]
+    #[arg(short = 'R', long)]
+    #[arg(value_name = fl!("recipients-file"))]
+    #[arg(help = fl!("help-flag-recipients-file"))]
     recipients_file: Vec<String>,
 
     #[arg(short, long)]
-    #[arg(help = "Use the identity file at IDENTITY. May be repeated.")]
+    #[arg(value_name = fl!("identity"))]
+    #[arg(help = fl!("help-flag-identity"))]
     identity: Vec<String>,
 
-    #[arg(short = 'j', value_name = "PLUGIN-NAME")]
-    #[arg(help = "Use age-plugin-PLUGIN-NAME in its default mode as an identity.")]
+    #[arg(short = 'j')]
+    #[arg(value_name = fl!("plugin-name"))]
+    #[arg(help = fl!("help-flag-plugin-name"))]
     plugin_name: Option<String>,
 
     #[arg(short, long)]
-    #[arg(help = "Write the result to the file at path OUTPUT.")]
+    #[arg(value_name = fl!("output"))]
+    #[arg(help = fl!("help-flag-output"))]
     output: Option<String>,
 }
 
diff --git a/rage/tests/cmd/rage-mount/help.toml b/rage/tests/cmd/rage-mount/help.toml
index c78c567..9d41fbd 100644
--- a/rage/tests/cmd/rage-mount/help.toml
+++ b/rage/tests/cmd/rage-mount/help.toml
@@ -12,6 +12,6 @@ Options:
   -V, --version               Print version info and exit.
   -t, --types <TYPES>         Indicates the filesystem type (one of "tar", "zip").
       --max-work-factor <WF>  Maximum work factor to allow for passphrase decryption.
-  -i, --identity <IDENTITY>   Use the private key file at IDENTITY. May be repeated.
+  -i, --identity <IDENTITY>   Use the identity file at IDENTITY. May be repeated.
 """
 stderr = ""
diff --git a/rage/tests/cmd/rage-mount/help_it.toml b/rage/tests/cmd/rage-mount/help_it.toml
index 28f4e66..eff77d6 100644
--- a/rage/tests/cmd/rage-mount/help_it.toml
+++ b/rage/tests/cmd/rage-mount/help_it.toml
@@ -13,6 +13,6 @@ Options:
   -V, --version               Print version info and exit.
   -t, --types <TYPES>         Indicates the filesystem type (one of "tar", "zip").
       --max-work-factor <WF>  Maximum work factor to allow for passphrase decryption.
-  -i, --identity <IDENTITY>   Use the private key file at IDENTITY. May be repeated.
+  -i, --identity <IDENTITY>   Use the identity file at IDENTITY. May be repeated.
 """
 stderr = ""