diff --git a/src/ui/i18n/en.rs b/src/ui/i18n/en.rs
index 13ebb202..09cc5b0a 100644
--- a/src/ui/i18n/en.rs
+++ b/src/ui/i18n/en.rs
@@ -233,6 +233,12 @@ pub fn translate_en(key: L10nKey) -> &'static str {
         L10nKey::SettingsAdvancedSummary => {
             "algorithms / keepalive / proxies / X11 / login scripts"
         }
+        L10nKey::SettingsGroupAuthentication => "Authentication",
+        L10nKey::SettingsGroupProxies => "Proxies",
+        L10nKey::SettingsGroupAlgorithms => "Algorithms",
+        L10nKey::SettingsGroupConnection => "Connection",
+        L10nKey::SettingsGroupSession => "Session",
+        L10nKey::SettingsGroupSecurity => "Security",
         L10nKey::SettingsIdentityFiles => "Identity files",
         L10nKey::SettingsIdentityFilesDesc => "Private-key paths, one per line (%h/%r expand).",
         L10nKey::SettingsAgentForwarding => "Agent forwarding",
diff --git a/src/ui/i18n/ja.rs b/src/ui/i18n/ja.rs
index 7f1d994f..e412f4b6 100644
--- a/src/ui/i18n/ja.rs
+++ b/src/ui/i18n/ja.rs
@@ -231,6 +231,12 @@ pub fn translate_ja(key: L10nKey) -> Option<&'static str> {
         L10nKey::SettingsAdvancedSummary => {
             "アルゴリズム / キープアライブ / プロキシ / X11 / ログインスクリプト"
         }
+        L10nKey::SettingsGroupAuthentication => "認証",
+        L10nKey::SettingsGroupProxies => "プロキシ",
+        L10nKey::SettingsGroupAlgorithms => "アルゴリズム",
+        L10nKey::SettingsGroupConnection => "接続",
+        L10nKey::SettingsGroupSession => "セッション",
+        L10nKey::SettingsGroupSecurity => "セキュリティ",
         L10nKey::SettingsIdentityFiles => "秘密鍵ファイル",
         L10nKey::SettingsIdentityFilesDesc => "秘密鍵のパス（1 行に 1 つ。%h/%r は展開されます）",
         L10nKey::SettingsAgentForwarding => "エージェント転送",
diff --git a/src/ui/i18n/mod.rs b/src/ui/i18n/mod.rs
index b8235699..1923d259 100644
--- a/src/ui/i18n/mod.rs
+++ b/src/ui/i18n/mod.rs
@@ -250,6 +250,12 @@ l10n_keys! {
     SettingsFwdNeedsListen,
     SettingsAdvanced,
     SettingsAdvancedSummary,
+    SettingsGroupAuthentication,
+    SettingsGroupProxies,
+    SettingsGroupAlgorithms,
+    SettingsGroupConnection,
+    SettingsGroupSession,
+    SettingsGroupSecurity,
     SettingsIdentityFiles,
     SettingsIdentityFilesDesc,
     SettingsAgentForwarding,
@@ -1156,6 +1162,30 @@ mod tests {
             L10nKey::ForwardSocksLabel,
             L10nKey::RemoteInstallShaLabel,
             L10nKey::SettingsAuthMode2Fa,
+            L10nKey::SettingsJumpHost,
+            L10nKey::SettingsJumpHostDesc,
+            L10nKey::SettingsNoneSummary,
+            L10nKey::SettingsNoneLower,
+            L10nKey::SettingsPortForwarding,
+            L10nKey::SettingsRulesOpenedWithConnection,
+            L10nKey::SettingsAddRule,
+            L10nKey::SettingsFwdLegendLocal,
+            L10nKey::SettingsFwdLegendRemote,
+            L10nKey::SettingsFwdLegendDynamic,
+            L10nKey::SettingsFwdNeedsBoth,
+            L10nKey::SettingsFwdNeedsListen,
+            L10nKey::SettingsAdvanced,
+            L10nKey::SettingsAdvancedSummary,
+            L10nKey::SettingsGroupAuthentication,
+            L10nKey::SettingsGroupProxies,
+            L10nKey::SettingsGroupAlgorithms,
+            L10nKey::SettingsGroupConnection,
+            L10nKey::SettingsGroupSession,
+            L10nKey::SettingsGroupSecurity,
+            L10nKey::SettingsIdentityFiles,
+            L10nKey::SettingsIdentityFilesDesc,
+            L10nKey::SettingsAgentForwarding,
+            L10nKey::SettingsAgentForwardingDesc,
             L10nKey::SettingsProxyCommand,
             L10nKey::SftpContextChmod,
             L10nKey::SettingsShell,
diff --git a/src/ui/i18n/zh.rs b/src/ui/i18n/zh.rs
index 076fb26f..5c70907e 100644
--- a/src/ui/i18n/zh.rs
+++ b/src/ui/i18n/zh.rs
@@ -203,6 +203,12 @@ pub fn translate_zh(key: L10nKey) -> Option<&'static str> {
         L10nKey::SettingsFwdNeedsListen => "需要监听端口——不会被保存。",
         L10nKey::SettingsAdvanced => "高级",
         L10nKey::SettingsAdvancedSummary => "算法 / 保活 / 代理 / X11 / 登录脚本",
+        L10nKey::SettingsGroupAuthentication => "认证",
+        L10nKey::SettingsGroupProxies => "代理",
+        L10nKey::SettingsGroupAlgorithms => "算法",
+        L10nKey::SettingsGroupConnection => "连接",
+        L10nKey::SettingsGroupSession => "会话",
+        L10nKey::SettingsGroupSecurity => "安全",
         L10nKey::SettingsIdentityFiles => "身份文件",
         L10nKey::SettingsIdentityFilesDesc => "私钥路径，每行一个（支持 %h/%r 展开）。",
         L10nKey::SettingsAgentForwarding => "ssh-agent 转发",
diff --git a/src/ui/settings.rs b/src/ui/settings.rs
index 880ed836..20dbfbac 100644
--- a/src/ui/settings.rs
+++ b/src/ui/settings.rs
@@ -998,6 +998,18 @@ impl Tty7App {
             .child(title.to_string())
     }
 
+    /// A heading *inside* a section — quieter than `section_header`, for
+    /// breaking a long run of rows into groups you can scan.
+    fn subgroup_header(&self, key: L10nKey, cx: &Context<Self>) -> Div {
+        div()
+            .pt_4()
+            .pb_1()
+            .text_xs()
+            .font_weight(FontWeight::MEDIUM)
+            .text_color(cx.theme().muted_foreground)
+            .child(t(key))
+    }
+
     pub(crate) fn section_header(&self, title: &str, cx: &Context<Self>) -> Div {
         self.header_text(title, cx).mb_4()
     }
@@ -3219,6 +3231,7 @@ impl Tty7App {
         };
 
         section = section
+            .child(self.subgroup_header(L10nKey::SettingsGroupAuthentication, cx))
             .child(text_row(
                 self,
                 t(L10nKey::SettingsIdentityFiles),
@@ -3242,6 +3255,7 @@ impl Tty7App {
                     cx,
                 ),
             )
+            .child(self.subgroup_header(L10nKey::SettingsGroupProxies, cx))
             .child(text_row(
                 self,
                 t(L10nKey::SettingsProxyCommand),
@@ -3263,6 +3277,7 @@ impl Tty7App {
                 &form.http,
                 cx,
             ))
+            .child(self.subgroup_header(L10nKey::SettingsGroupAlgorithms, cx))
             .child(text_row(
                 self,
                 t(L10nKey::SettingsKexAlgorithms),
@@ -3291,6 +3306,7 @@ impl Tty7App {
                 &form.hostkey,
                 cx,
             ))
+            .child(self.subgroup_header(L10nKey::SettingsGroupConnection, cx))
             .child(text_row(
                 self,
                 t(L10nKey::SettingsCompression),
@@ -3319,6 +3335,7 @@ impl Tty7App {
                 &form.connect_timeout,
                 cx,
             ))
+            .child(self.subgroup_header(L10nKey::SettingsGroupSession, cx))
             .child(
                 self.settings_row(
                     t(L10nKey::SettingsX11Forwarding),
@@ -3374,6 +3391,7 @@ impl Tty7App {
                     cx,
                 ),
             )
+            .child(self.subgroup_header(L10nKey::SettingsGroupSecurity, cx))
             .child(self.settings_row(
                 t(L10nKey::SettingsVerifyHostKeys),
                 t_fmt(