diff --git a/bootstrap.sh b/bootstrap.sh
index 9a02cd7..b66952a 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -347,6 +347,49 @@ if [ "$MESH_CONNECTED" = "netbird" ]; then
     fi
 fi
 
+# -------- ssh ControlMaster for netbird peers (workstations) --------
+# Drop a Host block into the enrolling user's ~/.ssh/config so that ssh to
+# `*.netbird.selfhosted` multiplexes over a single connection. After one SSO
+# device-code completion, subsequent ssh / scp / `pct exec` invocations
+# (within ControlPersist=2h) reuse the master socket with no re-auth — the
+# real workaround for netbird's flaky SSH JWT cache. Skip on LXCs (no
+# outbound ssh expected from them).
+HKIND="$(python3 -c "import yaml; print(yaml.safe_load(open('$HOST_YAML')).get('kind',''))" 2>/dev/null || true)"
+if [ "$MESH_CONNECTED" = "netbird" ] && [ "$HKIND" != "lxc" ]; then
+    if [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ]; then
+        SSH_USER_HOME=$(eval echo "~$SUDO_USER")
+        SSH_OWNER="$SUDO_USER"
+    else
+        SSH_USER_HOME="$HOME"
+        SSH_OWNER=""
+    fi
+    SSH_CFG="$SSH_USER_HOME/.ssh/config"
+    SSH_CM_DIR="$SSH_USER_HOME/.ssh/cm"
+    SENTINEL="# homelab-bootstrap: ssh ControlMaster for netbird mesh"
+    if [ "$DRY_RUN" -eq 1 ]; then
+        echo "+ would write Host *.netbird.selfhosted ControlMaster block into $SSH_CFG"
+    elif [ -f "$SSH_CFG" ] && grep -qF "$SENTINEL" "$SSH_CFG"; then
+        echo "[bootstrap] ssh ControlMaster block already present in $SSH_CFG (skip)"
+    else
+        mkdir -p "$SSH_USER_HOME/.ssh" "$SSH_CM_DIR"
+        chmod 700 "$SSH_USER_HOME/.ssh" "$SSH_CM_DIR"
+        cat >> "$SSH_CFG" <<'SSHEOF'
+
+# homelab-bootstrap: ssh ControlMaster for netbird mesh
+# One SSO covers many back-to-back ssh/scp/pct ops within ControlPersist.
+Host *.netbird.selfhosted
+    ControlMaster auto
+    ControlPath ~/.ssh/cm/%C
+    ControlPersist 2h
+SSHEOF
+        chmod 600 "$SSH_CFG"
+        if [ -n "$SSH_OWNER" ]; then
+            chown -R "$SSH_OWNER":"$SSH_OWNER" "$SSH_USER_HOME/.ssh"
+        fi
+        echo "[bootstrap] ssh: installed ControlMaster block into $SSH_CFG"
+    fi
+fi
+
 # -------- done --------
 cat <<EOF