diff --git a/cmd/tailscale/cli/up.go b/cmd/tailscale/cli/up.go
index 8f9f93516..8833b0a5f 100644
--- a/cmd/tailscale/cli/up.go
+++ b/cmd/tailscale/cli/up.go
@@ -440,7 +440,10 @@ func runUp(ctx context.Context, args []string) error {
 			return errors.New("--exit-node is " + notSupported)
 		}
 		if upArgs.netfilterMode != "off" {
-			return errors.New("--netfilter-mode values besides \"off\" " + notSupported)
+			return errors.New("--netfilter-mode values besides \"off\" are " + notSupported)
+		}
+		if upArgs.runSSH {
+			return errors.New("--ssh is " + notSupported)
 		}
 	}