diff --git a/cli/pom.xml b/cli/pom.xml
index 4e0636df982bb73a8ceadf2209088d82d512dc9f..6d97d9672935abac91294117d7775e844b12fee2 100644
--- a/cli/pom.xml
+++ b/cli/pom.xml
@@ -55,7 +55,7 @@
     <dependency>
       <groupId>org.apache.sshd</groupId>
       <artifactId>sshd-core</artifactId>
-      <version>1.2.0</version> <!-- TODO 1.3.0 requires Java 8 -->
+      <version>1.6.0</version>
       <optional>true</optional> <!-- do not expose to core -->
     </dependency>
     <dependency>
diff --git a/cli/src/main/java/hudson/cli/SSHCLI.java b/cli/src/main/java/hudson/cli/SSHCLI.java
index 023a304e7f76319004292181fe8b5da1470bb4ce..bdd6c2beb50e5e696af3467e5bae7598f41eb5ef 100644
--- a/cli/src/main/java/hudson/cli/SSHCLI.java
+++ b/cli/src/main/java/hudson/cli/SSHCLI.java
@@ -47,9 +47,9 @@ import org.apache.sshd.client.keyverifier.KnownHostsServerKeyVerifier;
 import org.apache.sshd.client.keyverifier.ServerKeyVerifier;
 import org.apache.sshd.client.session.ClientSession;
 import org.apache.sshd.common.future.WaitableFuture;
-import org.apache.sshd.common.util.SecurityUtils;
 import org.apache.sshd.common.util.io.NoCloseInputStream;
 import org.apache.sshd.common.util.io.NoCloseOutputStream;
+import org.apache.sshd.common.util.security.SecurityUtils;
 
 /**
  * Implements SSH connection mode of {@link CLI}.
diff --git a/test/src/test/java/hudson/cli/CLITest.java b/test/src/test/java/hudson/cli/CLITest.java
index 41d6756a32ae628a357591ff053edb18d5747f1e..cd0f3b9a66b56e9464e6910b24a595bc3001a760 100644
--- a/test/src/test/java/hudson/cli/CLITest.java
+++ b/test/src/test/java/hudson/cli/CLITest.java
@@ -26,7 +26,6 @@ package hudson.cli;
 
 import com.gargoylesoftware.htmlunit.WebResponse;
 import com.google.common.collect.Lists;
-import hudson.Functions;
 import hudson.Launcher;
 import hudson.Proc;
 import hudson.model.FreeStyleProject;
@@ -48,6 +47,7 @@ import jenkins.model.Jenkins;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.io.output.TeeOutputStream;
+import org.apache.sshd.common.util.io.ModifiableFileWatcher;
 import static org.hamcrest.Matchers.*;
 import org.jenkinsci.main.modules.cli.auth.ssh.UserPropertyImpl;
 import org.jenkinsci.main.modules.sshd.SSHD;
@@ -102,11 +102,8 @@ public class CLITest {
         } catch (IOException x) {
             assumeNoException("Sometimes on Windows KnownHostsServerKeyVerifier.acceptIncompleteHostKeys says WARNING: Failed (FileSystemException) to reload server keys from …\\\\.ssh\\\\known_hosts: … Incorrect function.", x);
         }
-        /* TODO impossible to do this until the bundled sshd module uses a sufficiently new version of sshd-core:
         assumeThat("or on Windows DefaultKnownHostsServerKeyVerifier.reloadKnownHosts says invalid file permissions: Owner violation (Administrators)",
             ModifiableFileWatcher.validateStrictConfigFilePermissions(known_hosts.toPath()), nullValue());
-        */
-        assumeFalse(Functions.isWindows()); // TODO can remove when above check is restored
         return home;
     }
 
diff --git a/war/pom.xml b/war/pom.xml
index c350066e2ca44d1faaf208b5d9f26564b3f668d4..74736e0a7729f2916e90d952ef46c31b05ce2966 100644
--- a/war/pom.xml
+++ b/war/pom.xml
@@ -134,7 +134,7 @@ THE SOFTWARE.
     <dependency>
       <groupId>org.jenkins-ci.modules</groupId>
       <artifactId>sshd</artifactId>
-      <version>1.11</version>
+      <version>2.0</version>
     </dependency>
     <dependency>
       <groupId>org.jenkins-ci.ui</groupId>