diff --git a/roles/sshd/README.md b/roles/sshd/README.md
index 6702986..545e928 100644
--- a/roles/sshd/README.md
+++ b/roles/sshd/README.md
@@ -11,7 +11,14 @@ None
 Role Variables
 --------------
 
-None
+- `sshd_disable_pam`: whether to disable PAM support. Default: `false`
+- `sshd_password_auth`: whether to allow password authentication. Default: `false`
+- `sshd_challenge_response_auth`: whether to allow challenge-response authentication. Default: `false`
+- `sshd_gss_api_auth`: whether to allow GSSAPI authentication. Default: `false`
+- `sshd_allow_agent_forwarding`: whether to allow SSH agent forwarding. Default: `false`
+- `sshd_allow_tcp_forwarding`: whether to allow TCP forwarding. Default: `false`
+- `sshd_gateway_ports`: whether to allow gateway ports. Default: `false`
+- `sshd_permit_tunnel`: whether to allow SSH tunneling. Default: `false`
 
 Dependencies
 ------------
diff --git a/roles/sshd/defaults/main.yml b/roles/sshd/defaults/main.yml
index 5354282..4169bdb 100644
--- a/roles/sshd/defaults/main.yml
+++ b/roles/sshd/defaults/main.yml
@@ -3,3 +3,7 @@ sshd_disable_pam: false
 sshd_password_auth: false
 sshd_challenge_response_auth: false
 sshd_gss_api_auth: false
+sshd_allow_agent_forwarding: false
+sshd_allow_tcp_forwarding: false
+sshd_gateway_ports: false
+sshd_permit_tunnel: false
diff --git a/roles/sshd/tasks/restrictions.yml b/roles/sshd/tasks/restrictions.yml
index c3e978f..7a96479 100644
--- a/roles/sshd/tasks/restrictions.yml
+++ b/roles/sshd/tasks/restrictions.yml
@@ -10,6 +10,10 @@
     - { regexp: '^#?\s*KbdInteractiveAuthentication\s+', line: 'KbdInteractiveAuthentication no' }
     - { regexp: '^#?\s*HostbasedAuthentication\s+', line: 'HostbasedAuthentication no' }
     - { regexp: '^#?\s*PermitUserEnvironment\s+', line: 'PermitUserEnvironment no' }
+    - { regexp: '^#?\s*AllowAgentForwarding\s+', line: 'AllowAgentForwarding {{ sshd_allow_agent_forwarding | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*AllowTcpForwarding\s+', line: 'AllowTcpForwarding {{ sshd_allow_tcp_forwarding | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*GatewayPorts\s+', line: 'GatewayPorts {{ sshd_gateway_ports | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*PermitTunnel\s+', line: 'PermitTunnel {{ sshd_permit_tunnel | ternary("yes", "no") }}' }
     - { regexp: '^#?\s*StrictModes\s+', line: 'StrictModes yes' }
     - { regexp: '^#?\s*IgnoreUserKnownHosts\s+', line: 'IgnoreUserKnownHosts yes' }
   ansible.builtin.lineinfile: