diff --git a/client/server/setconfig_test.go b/client/server/setconfig_test.go
index 1260bcc78..339d02bac 100644
--- a/client/server/setconfig_test.go
+++ b/client/server/setconfig_test.go
@@ -167,30 +167,35 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 	}
 
 	expectedFields := map[string]bool{
-		"ManagementUrl":         true,
-		"AdminURL":              true,
-		"RosenpassEnabled":      true,
-		"RosenpassPermissive":   true,
-		"ServerSSHAllowed":      true,
-		"InterfaceName":         true,
-		"WireguardPort":         true,
-		"OptionalPreSharedKey":  true,
-		"DisableAutoConnect":    true,
-		"NetworkMonitor":        true,
-		"DisableClientRoutes":   true,
-		"DisableServerRoutes":   true,
-		"DisableDns":            true,
-		"DisableFirewall":       true,
-		"BlockLanAccess":        true,
-		"DisableNotifications":  true,
-		"LazyConnectionEnabled": true,
-		"BlockInbound":          true,
-		"NatExternalIPs":        true,
-		"CustomDNSAddress":      true,
-		"ExtraIFaceBlacklist":   true,
-		"DnsLabels":             true,
-		"DnsRouteInterval":      true,
-		"Mtu":                   true,
+		"ManagementUrl":                true,
+		"AdminURL":                     true,
+		"RosenpassEnabled":             true,
+		"RosenpassPermissive":          true,
+		"ServerSSHAllowed":             true,
+		"InterfaceName":                true,
+		"WireguardPort":                true,
+		"OptionalPreSharedKey":         true,
+		"DisableAutoConnect":           true,
+		"NetworkMonitor":               true,
+		"DisableClientRoutes":          true,
+		"DisableServerRoutes":          true,
+		"DisableDns":                   true,
+		"DisableFirewall":              true,
+		"BlockLanAccess":               true,
+		"DisableNotifications":         true,
+		"LazyConnectionEnabled":        true,
+		"BlockInbound":                 true,
+		"NatExternalIPs":               true,
+		"CustomDNSAddress":             true,
+		"ExtraIFaceBlacklist":          true,
+		"DnsLabels":                    true,
+		"DnsRouteInterval":             true,
+		"Mtu":                          true,
+		"EnableSSHRoot":                true,
+		"EnableSSHSFTP":                true,
+		"EnableSSHLocalPortForward":    true,
+		"EnableSSHRemotePortForward":   true,
+		"DisableSSHAuth":               true,
 	}
 
 	val := reflect.ValueOf(req).Elem()
@@ -221,29 +226,34 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 	// Map of CLI flag names to their corresponding SetConfigRequest field names.
 	// This map must be updated when adding new config-related CLI flags.
 	flagToField := map[string]string{
-		"management-url":         "ManagementUrl",
-		"admin-url":              "AdminURL",
-		"enable-rosenpass":       "RosenpassEnabled",
-		"rosenpass-permissive":   "RosenpassPermissive",
-		"allow-server-ssh":       "ServerSSHAllowed",
-		"interface-name":         "InterfaceName",
-		"wireguard-port":         "WireguardPort",
-		"preshared-key":          "OptionalPreSharedKey",
-		"disable-auto-connect":   "DisableAutoConnect",
-		"network-monitor":        "NetworkMonitor",
-		"disable-client-routes":  "DisableClientRoutes",
-		"disable-server-routes":  "DisableServerRoutes",
-		"disable-dns":            "DisableDns",
-		"disable-firewall":       "DisableFirewall",
-		"block-lan-access":       "BlockLanAccess",
-		"block-inbound":          "BlockInbound",
-		"enable-lazy-connection": "LazyConnectionEnabled",
-		"external-ip-map":        "NatExternalIPs",
-		"dns-resolver-address":   "CustomDNSAddress",
-		"extra-iface-blacklist":  "ExtraIFaceBlacklist",
-		"extra-dns-labels":       "DnsLabels",
-		"dns-router-interval":    "DnsRouteInterval",
-		"mtu":                    "Mtu",
+		"management-url":                       "ManagementUrl",
+		"admin-url":                            "AdminURL",
+		"enable-rosenpass":                     "RosenpassEnabled",
+		"rosenpass-permissive":                 "RosenpassPermissive",
+		"allow-server-ssh":                     "ServerSSHAllowed",
+		"interface-name":                       "InterfaceName",
+		"wireguard-port":                       "WireguardPort",
+		"preshared-key":                        "OptionalPreSharedKey",
+		"disable-auto-connect":                 "DisableAutoConnect",
+		"network-monitor":                      "NetworkMonitor",
+		"disable-client-routes":                "DisableClientRoutes",
+		"disable-server-routes":                "DisableServerRoutes",
+		"disable-dns":                          "DisableDns",
+		"disable-firewall":                     "DisableFirewall",
+		"block-lan-access":                     "BlockLanAccess",
+		"block-inbound":                        "BlockInbound",
+		"enable-lazy-connection":               "LazyConnectionEnabled",
+		"external-ip-map":                      "NatExternalIPs",
+		"dns-resolver-address":                 "CustomDNSAddress",
+		"extra-iface-blacklist":                "ExtraIFaceBlacklist",
+		"extra-dns-labels":                     "DnsLabels",
+		"dns-router-interval":                  "DnsRouteInterval",
+		"mtu":                                  "Mtu",
+		"enable-ssh-root":                      "EnableSSHRoot",
+		"enable-ssh-sftp":                      "EnableSSHSFTP",
+		"enable-ssh-local-port-forwarding":     "EnableSSHLocalPortForward",
+		"enable-ssh-remote-port-forwarding":    "EnableSSHRemotePortForward",
+		"disable-ssh-auth":                     "DisableSSHAuth",
 	}
 
 	// SetConfigRequest fields that don't have CLI flags (settable only via UI or other means).