diff --git a/docs/administration/config-cheat-sheet.md b/docs/administration/config-cheat-sheet.md
index 93fc0163..83fb522a 100644
--- a/docs/administration/config-cheat-sheet.md
+++ b/docs/administration/config-cheat-sheet.md
@@ -365,6 +365,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a
 - `PPROF_DATA_PATH`: **_`AppWorkPath`_/data/tmp/pprof**: `PPROF_DATA_PATH`, use an absolute path when you start Gitea as service
 - `LANDING_PAGE`: **home**: Landing page for unauthenticated users \[home, explore, organizations, login, **custom**\]. Where custom would instead be any URL such as "/org/repo" or even `https://anotherwebsite.com`
 - `LFS_START_SERVER`: **false**: Enables Git LFS support.
+- `LFS_ALLOW_PURE_SSH`: **false**: Enables Git LFS Pure SSH protocol support. Currently disabled by default, see [Git LFS Support](administration/git-lfs-support.md).
 - `LFS_CONTENT_PATH`: **%(APP_DATA_PATH)s/lfs**: Default LFS content path. (if it is on local storage.) **DEPRECATED** use settings in `[lfs]`.
 - `LFS_JWT_SECRET`: **_empty_**: LFS authentication secret, change this a unique string. You can generate one via Gitea sub command. Ref [Command Line](administration/command-line.md#generate)
 - `LFS_JWT_SECRET_URI`: **_empty_**: Instead of defining LFS_JWT_SECRET in the configuration, this configuration option can be used to give Gitea a path to a file that contains the secret (example value: `file:/etc/gitea/lfs_jwt_secret`)
diff --git a/docs/administration/git-lfs-support.md b/docs/administration/git-lfs-support.md
index e5d595e7..4a390721 100644
--- a/docs/administration/git-lfs-support.md
+++ b/docs/administration/git-lfs-support.md
@@ -23,3 +23,21 @@ PATH = /home/gitea/data/lfs
 :::note
 LFS server support needs at least Git v2.1.2 installed on the server
 :::
+
+# Git LFS Pure SSH protocol
+
+The LFS Pure SSH protocol supports making LFS connections purely over SSH
+(without having to expose an HTTP endpoint for the Gitea server).
+Support for it can be enabled with the config option `server.LFS_ALLOW_PURE_SSH`:
+
+```ini
+[server]
+LFS_ALLOW_PURE_SSH = true
+```
+
+:::note
+The option is currently set to default false due to an open bug in the `git-lfs`
+client that causes SSH transfers to hang: https://github.com/git-lfs/git-lfs/pull/5816
+This can be worked around on all the client machines by setting the git config:
+`git config --global lfs.ssh.automultiplex false`
+:::