diff --git a/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page b/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page
index 50b064f..0a8dc41 100644
--- a/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page
+++ b/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page
@@ -144,7 +144,7 @@ _(Enable NetBird SSH)_:
   </select>
 
 <blockquote class="inline_help">
-Runs NetBird's built-in SSH server so other peers can SSH into this Unraid host using NetBird identity (no separate SSH keys to manage). <b>Security:</b> this exposes SSH to any peer your NetBird access controls permit, so leave it disabled unless you need it. SSH must also be enabled for this peer in the NetBird dashboard. Changing this reconnects NetBird to take effect.
+Runs NetBird's built-in SSH server so other peers can SSH into this Unraid host as <code>root</code> using NetBird identity (no separate SSH keys to manage). <b>Security:</b> this grants root SSH to any peer your NetBird access controls permit, so leave it disabled unless you need it. You must also enable SSH for this peer and create an access control policy in the NetBird dashboard — see <a href="https://docs.netbird.io/manage/peers/ssh#step-2-create-access-control-policy" target="_blank" rel="noopener noreferrer">the NetBird SSH guide</a>. Changing this reconnects NetBird to take effect.
 </blockquote>
 
 : <input type="button" value="_(Apply)_" onclick="nbSaveSettings()"><input type="button" value="_(Done)_" onclick="done()">
diff --git a/src/usr/local/emhttp/plugins/netbird/include/action.php b/src/usr/local/emhttp/plugins/netbird/include/action.php
index 69136ed..4745bf7 100644
--- a/src/usr/local/emhttp/plugins/netbird/include/action.php
+++ b/src/usr/local/emhttp/plugins/netbird/include/action.php
@@ -99,8 +99,13 @@ function nb_up_args(array $creds): array
     if (!empty($creds['SETUP_KEY']))       { $args[] = '--setup-key';      $args[] = $creds['SETUP_KEY']; }
     if (!empty($creds['HOSTNAME']))        { $args[] = '--hostname';       $args[] = $creds['HOSTNAME']; }
     if (!empty($creds['PRESHARED_KEY']))   { $args[] = '--preshared-key';  $args[] = $creds['PRESHARED_KEY']; }
-    // NetBird's built-in SSH server is a host-wide (global) setting.
-    if ((Netbird\readCfg()['ENABLE_SSH'] ?? '0') === '1') { $args[] = '--allow-server-ssh'; }
+    // NetBird's built-in SSH server is a host-wide (global) setting. Unraid is a
+    // root-operated box, so we also permit root login (the server refuses it
+    // otherwise); without this the SSH server is effectively unusable here.
+    if ((Netbird\readCfg()['ENABLE_SSH'] ?? '0') === '1') {
+        $args[] = '--allow-server-ssh';
+        $args[] = '--enable-ssh-root';
+    }
     return $args;
 }
 
diff --git a/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh b/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh
index fbdb03b..a7829b2 100755
--- a/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh
+++ b/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh
@@ -147,7 +147,8 @@ UP_ARGS="up"
 [ -n "$HOSTNAME" ]       && UP_ARGS="$UP_ARGS --hostname $HOSTNAME"
 [ -n "$PRESHARED_KEY" ]  && UP_ARGS="$UP_ARGS --preshared-key $PRESHARED_KEY"
 # NetBird's built-in SSH server (host-wide global toggle from netbird.cfg).
-[ "$ENABLE_SSH" = "1" ]  && UP_ARGS="$UP_ARGS --allow-server-ssh"
+# Unraid is root-operated, so also permit root login (refused otherwise).
+[ "$ENABLE_SSH" = "1" ]  && UP_ARGS="$UP_ARGS --allow-server-ssh --enable-ssh-root"
 
 log "Running: netbird up (profile '$PROFILE', mode '$MODE')"
 OUT=$(timeout 90 "$NB" $UP_ARGS 2>&1)