diff --git a/Dockerfile b/Dockerfile
index 70f8ad1..4faf09a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,7 +31,8 @@ ENV DEBIAN_FRONTEND=noninteractive \
     WEB_SSH_PORT=3000 \
     WEBSSH2_LISTEN_PORT=3001 \
     WEBSSH2_SSH_HOST=127.0.0.1 \
-    WEBSSH2_SSH_PORT=22 \
+    WEBSSH2_SSH_PORT=2222 \
+    SSH_PORT=2222 \
     WEBSSH2_HEADER_TEXT=k8s-mgmt-pod \
     WEBSSH2_SSH_HOSTKEY_ENABLED=false
 
@@ -99,9 +100,9 @@ COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod 0755 /usr/local/bin/entrypoint.sh \
     && chmod 0644 /etc/profile.d/20-k8s-tools-completion.sh
 
-EXPOSE 22 3000
+EXPOSE 2222 3000
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD nc -z 127.0.0.1 22 || exit 1
+    CMD nc -z 127.0.0.1 "${SSH_PORT:-2222}" || exit 1
 
 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint.sh"]
diff --git a/README.md b/README.md
index 308526d..62f3935 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@
 - `helm` preinstalled from a pinned upstream binary release
 - `k9s` preinstalled from a pinned GitHub release tarball
 - `kubectl` and `helm` bash autocompletion enabled for both `admin` and `user`
-- local `openssh-server` on port `22`
+- local `openssh-server` on port `2222`
 - a browser-based SSH client on port `3000`
 - a custom ASCII-art MOTD on login
 - two provisioned users: `admin` and `user`
@@ -20,7 +20,7 @@ One caveat is worth stating clearly: browser-based SSH tools do not keep the pri
 
 ## Ports
 
-- `22`: native SSH into the container's local `sshd`
+- `2222`: native SSH into the container's local `sshd`
 - `3000`: browser UI entrypoint; `/` and `/ssh` are forced to a fixed local WebSSH2 session for `127.0.0.1` and rewritten back to that host if changed in the URL
 
 ## Runtime environment variables
@@ -113,7 +113,7 @@ If `${HOME}/.kube/config` is missing on the host, the container logs that bootst
 
 ```bash
 docker run --rm \
-  -p 2222:22 \
+  -p 2222:2222 \
   -p 3000:3000 \
   -e ADMIN_SSH_PUBKEY="$(cat ~/.ssh/id_ed25519.pub)" \
   -e USER_SSH_PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIexample user@example" \
@@ -132,7 +132,7 @@ Or in a browser at `http://localhost:3000/`.
 
 ```bash
 docker run --rm \
-  -p 2222:22 \
+  -p 2222:2222 \
   -p 3000:3000 \
   -e ADMIN_PASSWORD='change-this-admin-password' \
   -e USER_PASSWORD='change-this-user-password' \
@@ -143,7 +143,7 @@ If that fails with a message like `unable to upgrade to tcp, received 500`, the
 
 ```bash
 docker run -d --name k8s-mgmt-pod \
-  -p 2222:22 \
+  -p 2222:2222 \
   -p 3000:3000 \
   -e ADMIN_PASSWORD='change-this-admin-password' \
   -e USER_PASSWORD='change-this-user-password' \
@@ -156,7 +156,7 @@ If Docker reports `bind: address already in use`, change the host-side ports or
 
 ```bash
 docker run --rm \
-  -p 127.0.0.1::22 \
+  -p 127.0.0.1::2222 \
   -p 127.0.0.1::3000 \
   -e ADMIN_PASSWORD='change-this-admin-password' \
   -e USER_PASSWORD='change-this-user-password' \
@@ -167,7 +167,7 @@ docker run --rm \
 
 ```bash
 docker run --rm \
-  -p 2222:22 \
+  -p 2222:2222 \
   -p 3000:3000 \
   -e ADMIN_SSH_PUBKEY="$(cat ~/.ssh/id_ed25519.pub)" \
   -e ADMIN_PASSWORD='change-this-admin-password' \
@@ -184,7 +184,7 @@ If you omit both the public-key and password variables for a user, the container
 
 ```bash
 docker run --rm \
-  -p 2222:22 \
+  -p 2222:2222 \
   -p 3000:3000 \
   -e ADMIN_SSH_PUBKEY="$(cat ~/.ssh/id_ed25519.pub)" \
   k8s-mgmt-pod:local
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 4f81d2e..95ff74a 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -6,7 +6,7 @@ services:
       dockerfile: Dockerfile
     container_name: k8s-mgmt-pod
     ports:
-      - "${HOST_SSH_PORT:-2222}:22"
+      - "${HOST_SSH_PORT:-2222}:2222"
       - "${HOST_WEBSSH_PORT:-3000}:3000"
     environment:
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:-change-this-admin-password}
diff --git a/docker/sshd/10-lfk-base.conf b/docker/sshd/10-lfk-base.conf
index 5b59dd1..cf982a6 100644
--- a/docker/sshd/10-lfk-base.conf
+++ b/docker/sshd/10-lfk-base.conf
@@ -1,4 +1,3 @@
-Port 22
 Protocol 2
 PermitRootLogin no
 PubkeyAuthentication yes
diff --git a/entrypoint.sh b/entrypoint.sh
index 30d4e14..458bd77 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -10,6 +10,12 @@ WEBSSH2_PID=""
 NGINX_PID=""
 BOOTSTRAP_KUBECONFIG="${BOOTSTRAP_KUBECONFIG:-/bootstrap/kubeconfig/config}"
 ENABLE_BOOTSTRAP_KUBECONFIG="${ENABLE_BOOTSTRAP_KUBECONFIG:-false}"
+SSH_PORT="${SSH_PORT:-2222}"
+
+if [[ -z "${WEBSSH2_SSH_PORT:-}" ]]; then
+  WEBSSH2_SSH_PORT="${SSH_PORT}"
+fi
+export WEBSSH2_SSH_PORT
 
 ensure_host_keys() {
   if [[ ! -f "${STATE_DIR}/ssh_host_rsa_key" ]]; then
@@ -187,6 +193,7 @@ render_sshd_auth_config() {
   fi
 
   cat > "${SSH_DYNAMIC_CONFIG}" <<EOF
+Port ${SSH_PORT}
 PasswordAuthentication ${password_value}
 KbdInteractiveAuthentication ${keyboard_interactive_value}
 EOF
@@ -212,7 +219,7 @@ start_services() {
   nginx -g 'daemon off;' &
   NGINX_PID=$!
 
-  log "sshd started on port 22."
+  log "sshd started on port ${SSH_PORT}."
   log "WebSSH2 started on port ${WEBSSH2_LISTEN_PORT}."
   log "nginx redirect/proxy started on port ${WEB_SSH_PORT}."
 
diff --git a/k8s/README.md b/k8s/README.md
index 7701555..8533a42 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -62,7 +62,7 @@ If you prefer individual files, apply `namespace.yaml`, `serviceaccount.yaml`, `
 Port-forward the service instead of exposing it externally by default:
 
 ```bash
-kubectl -n k8s-mgmt-pod port-forward svc/k8s-mgmt-pod 2222:22 3000:3000
+kubectl -n k8s-mgmt-pod port-forward svc/k8s-mgmt-pod 2222:2222 3000:3000
 ```
 
 Then connect with:
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 1bfb963..9bc3445 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -25,7 +25,7 @@ spec:
           imagePullPolicy: Always
           ports:
             - name: ssh
-              containerPort: 22
+              containerPort: 2222
               protocol: TCP
             - name: webssh
               containerPort: 3000
@@ -64,20 +64,20 @@ spec:
               memory: 512Mi
           readinessProbe:
             tcpSocket:
-              port: 22
+              port: 2222
             initialDelaySeconds: 5
             periodSeconds: 10
           livenessProbe:
             tcpSocket:
-              port: 22
+              port: 2222
             initialDelaySeconds: 15
             periodSeconds: 20
           volumeMounts:
             - name: state
               mountPath: /var/lib/k8s-mgmt-pod
           securityContext:
-            # sshd still runs as root here because it needs to bind port 22 and switch to the authenticated user session.
-            # The tradeoff is deliberate: keep the container functional, then narrow capabilities instead of forcing a fragile rootless sshd setup.
+            # sshd still runs as root to switch to authenticated user sessions.
+            # Binding uses a non-privileged port, so NET_BIND_SERVICE is not required.
             runAsUser: 0
             runAsGroup: 0
             runAsNonRoot: false
@@ -85,7 +85,7 @@ spec:
             readOnlyRootFilesystem: false
             capabilities:
               drop: ["ALL"]
-              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "NET_BIND_SERVICE", "SETGID", "SETUID"]
+              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
       volumes:
         - name: state
           emptyDir: {}
diff --git a/k8s/networkpolicy.yaml b/k8s/networkpolicy.yaml
index 78d2c24..4c36578 100644
--- a/k8s/networkpolicy.yaml
+++ b/k8s/networkpolicy.yaml
@@ -19,6 +19,6 @@ spec:
               k8s-mgmt-pod-access: "true"
       ports:
         - protocol: TCP
-          port: 22
+          port: 2222
         - protocol: TCP
           port: 3000
diff --git a/k8s/service.yaml b/k8s/service.yaml
index e99c602..4fbc2c2 100644
--- a/k8s/service.yaml
+++ b/k8s/service.yaml
@@ -8,7 +8,7 @@ spec:
     app.kubernetes.io/name: k8s-mgmt-pod
   ports:
     - name: ssh
-      port: 22
+      port: 2222
       targetPort: ssh
       protocol: TCP
     - name: webssh
@@ -27,7 +27,7 @@ spec:
 #     app.kubernetes.io/name: k8s-mgmt-pod
 #   ports:
 #     - name: ssh
-#       port: 22
+#       port: 2222
 #       targetPort: ssh
 #     - name: webssh
 #       port: 3000