diff --git a/cmd/firewall.go b/cmd/firewall.go
index f4759fd..a9ae97e 100644
--- a/cmd/firewall.go
+++ b/cmd/firewall.go
@@ -296,7 +296,7 @@ func (c *firewallCmd) firewallPureSSH(fwAllocation *models.V1MachineAllocation)
 		}
 		for _, ip := range nw.Ips {
 			if portOpen(ip, "22", time.Second) {
-				err = sshClient("metal", viper.GetString("identity"), ip, 22, nil, false)
+				err = sshClient("metal", viper.GetString("identity"), ip, 22, nil)
 				if err != nil {
 					return err
 				}
diff --git a/cmd/machine.go b/cmd/machine.go
index f070a10..f0bd2ff 100644
--- a/cmd/machine.go
+++ b/cmd/machine.go
@@ -466,7 +466,6 @@ In case the machine did not register properly a direct ipmi console access is av
 
 	machineConsoleCmd.Flags().StringP("sshidentity", "i", "", "SSH key file, if not given the default ssh key will be used if present [optional].")
 	machineConsoleCmd.Flags().BoolP("ipmi", "", false, "use ipmitool with direct network access (admin only).")
-	machineConsoleCmd.Flags().BoolP("admin", "", false, "authenticate as admin (admin only).")
 	machineConsoleCmd.Flags().StringP("ipmiuser", "", "", "overwrite ipmi user (admin only).")
 	machineConsoleCmd.Flags().StringP("ipmipassword", "", "", "overwrite ipmi password (admin only).")
 
@@ -1306,7 +1305,7 @@ func (c *machineCmd) machineConsole(args []string) error {
 		token = authContext.IDToken
 	}
 
-	err = sshClient(id, viper.GetString("sshidentity"), parsedurl.Host, bmcConsolePort, &token, viper.GetBool("admin"))
+	err = sshClient(id, viper.GetString("sshidentity"), parsedurl.Host, bmcConsolePort, &token)
 	if err != nil {
 		return fmt.Errorf("machine console error:%w", err)
 	}
diff --git a/cmd/ssh.go b/cmd/ssh.go
index 0c182fe..de2f02b 100644
--- a/cmd/ssh.go
+++ b/cmd/ssh.go
@@ -59,35 +59,33 @@ func (c *firewallCmd) firewallSSHViaVPN(firewall *models.V1FirewallResponse) (er
 }
 
 // sshClient opens an interactive ssh session to the host on port with user, authenticated by the key.
-func sshClient(user, keyfile, host string, port int, idToken *string, passwordAuth bool) error {
+func sshClient(user, keyfile, host string, port int, idToken *string) error {
 
 	var opts []metalssh.ConnectOpt
-	if passwordAuth {
-		opts = append(opts, metalssh.ConnectOptOutputPassword(*idToken))
-	} else {
-		if keyfile == "" {
-			var err error
-			keyfile, err = searchSSHKey()
-			if err != nil {
-				return err
-			}
-		}
-
-		privateKey, err := os.ReadFile(keyfile)
+	if keyfile == "" {
+		var err error
+		keyfile, err = searchSSHKey()
 		if err != nil {
 			return err
 		}
+	}
 
-		opts = append(opts, metalssh.ConnectOptOutputPrivateKey(privateKey))
+	privateKey, err := os.ReadFile(keyfile)
+	if err != nil {
+		return err
 	}
 
+	opts = append(opts, metalssh.ConnectOptOutputPrivateKey(privateKey))
+
 	s, err := metalssh.NewClient(user, host, port, opts...)
 	if err != nil {
 		return err
 	}
-	var env *metalssh.Env
-	if idToken != nil {
-		env = &metalssh.Env{"LC_METAL_STACK_OIDC_TOKEN": *idToken}
+
+	env := map[string]string{
+		"LC_METAL_STACK_OIDC_TOKEN": pointer.SafeDeref(idToken),
 	}
-	return s.Connect(env)
+	sshEnv := metalssh.Env(env)
+
+	return s.Connect(&sshEnv)
 }
diff --git a/docs/metalctl_machine_console.md b/docs/metalctl_machine_console.md
index 78de120..32308ad 100644
--- a/docs/metalctl_machine_console.md
+++ b/docs/metalctl_machine_console.md
@@ -14,7 +14,6 @@ metalctl machine console <machine ID> [flags]
 ### Options
 
 ```
-      --admin                 authenticate as admin (admin only).
   -h, --help                  help for console
       --ipmi                  use ipmitool with direct network access (admin only).
       --ipmipassword string   overwrite ipmi password (admin only).