diff --git a/bootstrap.sh b/bootstrap.sh
index 4b3e18d..9a02cd7 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -325,6 +325,28 @@ PYEOF
     fi
 fi
 
+# -------- netbird tuning (skip per-session SSO for ssh into mesh peers) --------
+# Apply the SSH JWT cache TTL so `ssh ... .netbird.selfhosted` doesn't trigger
+# device-code SSO on every connection. Flag added in netbird 0.71.x
+# (netbirdio/netbird#4015). It belongs on `netbird up` — putting it on the
+# daemon's ExecStart crashes the daemon with "unknown flag". After this runs the
+# FIRST ssh still prompts SSO once; subsequent sessions within 24h skip it.
+if [ "$MESH_CONNECTED" = "netbird" ]; then
+    if [ "$DRY_RUN" -eq 1 ]; then
+        echo "+ would: netbird down && netbird up --ssh-jwt-cache-ttl=86400"
+    elif netbird up --help 2>&1 | grep -q -- "--ssh-jwt-cache-ttl"; then
+        echo "[bootstrap] netbird: enabling ssh-jwt-cache-ttl=86400 (one SSO per 24h)"
+        # `netbird up` short-circuits with "Already connected" — need down first.
+        netbird down >/dev/null 2>&1 || true
+        if ! netbird up --ssh-jwt-cache-ttl=86400; then
+            echo "[bootstrap] WARNING: netbird up with --ssh-jwt-cache-ttl failed; rerun manually:"
+            echo "[bootstrap]   netbird down && netbird up --ssh-jwt-cache-ttl=86400"
+        fi
+    else
+        echo "[bootstrap] netbird: --ssh-jwt-cache-ttl flag not supported (need >=0.71.x); skipping"
+    fi
+fi
+
 # -------- done --------
 cat <<EOF