diff --git a/internal/api/router.go b/internal/api/router.go
index a465adf..1a244cb 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -1209,6 +1209,13 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 				}
 			}
 
+			// Allow SSH config endpoint when a setup token is provided
+			if normalizedPath == "/api/system/ssh-config" && r.configHandlers != nil {
+				if token := extractSetupToken(req); token != "" && r.configHandlers.ValidateSetupToken(token) {
+					isPublic = true
+				}
+			}
+
 			// Auto-register endpoint needs to be public (validates tokens internally)
 			// BUT the tokens must be generated by authenticated users via setup-script-url
 			if normalizedPath == "/api/auto-register" {