diff --git a/docs/deployment.rst b/docs/deployment.rst
index bd69f943f..cffb0831b 100644
--- a/docs/deployment.rst
+++ b/docs/deployment.rst
@@ -62,7 +62,8 @@ forced command and restrictions applied as shown below:
 
   command="cd /home/backup/repos/<client fqdn>;
            borg serve --restrict-path /home/backup/repos/<client fqdn>",
-           no-port-forwarding,no-X11-forwarding,no-pty <keytype> <key> <host>
+           no-port-forwarding,no-X11-forwarding,no-pty,
+           no-agent-forwarding,no-user-rc <keytype> <key> <host>
 
 .. note:: The text shown above needs to be written on a single line!
 
@@ -141,7 +142,7 @@ package manager to install and keep borg up-to-date.
     - file: path="{{ pool }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory
     - authorized_key: user="{{ user }}"
                       key="{{ item.key }}"
-                      key_options='command="cd {{ pool }}/{{ item.host }};borg serve --restrict-to-path {{ pool }}/{{ item.host }}",no-port-forwarding,no-X11-forwarding,no-pty'
+                      key_options='command="cd {{ pool }}/{{ item.host }};borg serve --restrict-to-path {{ pool }}/{{ item.host }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
       with_items: auth_users
     - file: path="{{ home }}/.ssh/authorized_keys" owner="{{ user }}" group="{{ group }}" mode=0600 state=file
     - file: path="{{ pool }}/{{ item.host }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory
diff --git a/docs/quickstart.rst b/docs/quickstart.rst
index 18457e9c7..ca7acc795 100644
--- a/docs/quickstart.rst
+++ b/docs/quickstart.rst
@@ -207,7 +207,7 @@ the remote server's authorized_keys file. Only the forced command will be run
 when the key authenticates a connection. This example will start |project_name| in server
 mode, and limit the |project_name| server to a specific filesystem path::
 
-  command="borg serve --restrict-to-path /mnt/backup" ssh-rsa AAAAB3[...]
+  command="borg serve --restrict-to-path /mnt/backup",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc ssh-rsa AAAAB3[...]
 
 If it is not possible to install |project_name| on the remote host,
 it is still possible to use the remote host to store a repository by
diff --git a/docs/usage.rst b/docs/usage.rst
index 73a60dc8e..e3a9ed7ba 100644
--- a/docs/usage.rst
+++ b/docs/usage.rst
@@ -419,9 +419,10 @@ Examples
 ::
 
     # Allow an SSH keypair to only run borg, and only have access to /mnt/backup.
+    # Use key options to disable unneeded and potentially dangerous SSH functionality.
     # This will help to secure an automated remote backup system.
     $ cat ~/.ssh/authorized_keys
-    command="borg serve --restrict-to-path /mnt/backup" ssh-rsa AAAAB3[...]
+    command="borg serve --restrict-to-path /mnt/backup",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc ssh-rsa AAAAB3[...]
 
 
 .. include:: usage/upgrade.rst.inc