diff --git a/cli_args.go b/cli_args.go
index 7e8deeb..69e8bdf 100644
--- a/cli_args.go
+++ b/cli_args.go
@@ -221,6 +221,10 @@ func parseCliOpts() (args argContainer) {
 		tlog.Fatal.Printf("The options -extpass and -masterkey cannot be used at the same time")
 		os.Exit(exitcodes.Usage)
 	}
+	if args.extpass != "" && args.trezor {
+		tlog.Fatal.Printf("The options -extpass and -trezor cannot be used at the same time")
+		os.Exit(exitcodes.Usage)
+	}
 	return args
 }
 
diff --git a/tests/trezor/trezor_test.go b/tests/trezor/trezor_test.go
index ba468d9..65f1f15 100644
--- a/tests/trezor/trezor_test.go
+++ b/tests/trezor/trezor_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/rfjakob/gocryptfs/internal/configfile"
+	"github.com/rfjakob/gocryptfs/internal/exitcodes"
 
 	"github.com/rfjakob/gocryptfs/tests/test_helpers"
 )
@@ -42,3 +43,13 @@ func TestInitTrezor(t *testing.T) {
 		t.Error("Trezor flag should be set but is not")
 	}
 }
+
+// Test using -trezor together with -extpass. Should fail with code 1 (usage error).
+func TestTrezorExtpass(t *testing.T) {
+	cmd := exec.Command(test_helpers.GocryptfsBinary, "-init", "-trezor", "-extpass", "foo", "/tmp")
+	err := cmd.Run()
+	exitCode := test_helpers.ExtractCmdExitCode(err)
+	if exitCode != exitcodes.Usage {
+		t.Errorf("wrong exit code: want %d, have %d", exitcodes.Usage, exitCode)
+	}
+}