diff --git a/templates/index.html b/templates/index.html
index 326fe45..789fc20 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -741,6 +741,23 @@
           </div>
         </div>
 
+        <div style="margin-bottom:10px">
+          <div class="section-label" style="margin-bottom:6px">SSH Credentials (RADIUS)</div>
+          <div class="settings-grid">
+            <div class="setting-item full">
+              <span class="setting-label">SSH USERNAME</span>
+              <input type="text" id="s-ssh-username" value="">
+            </div>
+            <div class="setting-item full">
+              <span class="setting-label">SSH PASSWORD (plaintext)</span>
+              <input type="text" id="s-ssh-password" value="">
+            </div>
+          </div>
+          <div style="font-size:11px;color:var(--muted);margin-top:4px">
+            Used for the SSH login in Web Access Control (switches authenticate SSH via RADIUS, not the local admin account above).
+          </div>
+        </div>
+
         <div style="margin-bottom:10px">
           <div class="section-label" style="margin-bottom:6px">SNMP &amp; RADIUS</div>
           <div class="settings-grid">
@@ -928,6 +945,8 @@ function cfg() {
     gateway:      document.getElementById('s-gateway').value.trim(),
     defaultUsername: document.getElementById('s-username').value.trim(),
     defaultPassword: document.getElementById('s-password').value.trim(),
+    sshUsername: document.getElementById('s-ssh-username').value.trim(),
+    sshPassword: document.getElementById('s-ssh-password').value.trim(),
     engineId:     document.getElementById('s-engine-id').value.trim(),
     radius:       document.getElementById('s-radius').value.trim(),
     snmpSwitchmonAuth: document.getElementById('s-snmp-switchmon-auth').value.trim(),
@@ -1285,11 +1304,15 @@ function getWaTargetSwitches() {
   return switches; // all
 }
 
-function getCredentials(sw) {
+// SSH login to the switches goes through RADIUS, not the local admin
+// account used for the HTTPS GUI / baked into generated configs — so
+// Web Access Control uses its own credential fields, not per-switch
+// NocoDB creds or the DEFAULT USERNAME/PASSWORD settings.
+function getSshCredentials() {
   const c = cfg();
   return {
-    username: (sw.Username || '').trim() || c.defaultUsername || 'admin',
-    password: (sw.Password || '').trim() || c.defaultPassword || '',
+    username: c.sshUsername,
+    password: c.sshPassword,
   };
 }
 
@@ -1324,7 +1347,7 @@ async function runWithConcurrency(tasks, concurrency, onStart, onDone) {
 }
 
 async function sendWebAccess(sw, action) {
-  const creds = getCredentials(sw);
+  const creds = getSshCredentials();
   const res = await fetch('/api/web-access', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -1371,6 +1394,12 @@ async function runWaOperation(action) {
     return;
   }
 
+  const sshCreds = getSshCredentials();
+  if (!sshCreds.username || !sshCreds.password) {
+    showToast('Set SSH USERNAME / SSH PASSWORD (RADIUS) in Settings first', 'err');
+    return;
+  }
+
   btnWaEnable.disabled  = true;
   btnWaDisable.disabled = true;
   btnWaDisableTelnet.disabled = true;