diff --git a/security/netbird/Makefile b/security/netbird/Makefile
index 491acab3e0..74b5fec4b0 100644
--- a/security/netbird/Makefile
+++ b/security/netbird/Makefile
@@ -1,6 +1,6 @@
 PLUGIN_NAME=		netbird
 PLUGIN_VERSION=		1.3
-PLUGIN_REVISION=	3
+PLUGIN_REVISION=	4
 PLUGIN_DEPENDS=		netbird
 PLUGIN_COMMENT=		Peer-to-peer VPN that seamlessly connects your devices
 PLUGIN_MAINTAINER=	dev@netbird.io
diff --git a/security/netbird/pkg-descr b/security/netbird/pkg-descr
index 0f19018c86..c3a0c14e40 100644
--- a/security/netbird/pkg-descr
+++ b/security/netbird/pkg-descr
@@ -25,3 +25,5 @@ Plugin Changelog
 * Added IP Mapping option and authentication banner (contributed by Konstantinos Spartalis)
 * Fix quantum peer state display (contributed by Konstantinos Spartalis)
 * Fix setupKey usage after UpdateOnlyTextField introduction
+* Say on the settings page that Apply restarts the daemon and drops the tunnel
+* Ask for confirmation before disconnecting NetBird
diff --git a/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/authentication.volt b/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/authentication.volt
index 96ec7ea570..1aa4e3be86 100644
--- a/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/authentication.volt
+++ b/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/authentication.volt
@@ -42,10 +42,12 @@
                 let message;
                 let type;
                 if (!isEnabled) {
-                    message = "Enable NetBird first";
+                    message = "{{ lang._('Enable NetBird first') }}";
                     type = "warning";
                 } else {
-                    message = isConnected ? "NetBird is connected" : "NetBird is not connected";
+                    message = isConnected
+                        ? "{{ lang._('NetBird is connected') }}"
+                        : "{{ lang._('NetBird is not connected') }}";
                     type = isConnected ? "info" : "warning";
                 }
 
@@ -91,6 +93,45 @@
         });
 
         $("#disconnectBtn").SimpleActionButton({
+            /*
+             * One click here takes the tunnel offline, and an admin who reaches
+             * this firewall through NetBird is on it. SimpleActionButton has no
+             * confirm of its own; it runs the endpoint when this deferred
+             * resolves, so rejecting it is how the action is called off.
+             */
+            onPreAction: () => {
+                const dfObj = new $.Deferred();
+                BootstrapDialog.show({
+                    type: BootstrapDialog.TYPE_WARNING,
+                    title: "{{ lang._('Disconnect NetBird') }}",
+                    message: "{{ lang._('This takes the tunnel offline. If you are reaching this firewall through NetBird, this session ends here and you will need another way in to reconnect it.') }}",
+                    buttons: [
+                        {
+                            label: "{{ lang._('Cancel') }}",
+                            action: (dialog) => {
+                                /* settle before closing: the onhide below fires on the way out */
+                                dfObj.reject();
+                                dialog.close();
+                            }
+                        },
+                        {
+                            label: "{{ lang._('Disconnect') }}",
+                            cssClass: 'btn-warning',
+                            action: (dialog) => {
+                                dfObj.resolve();
+                                dialog.close();
+                            }
+                        }
+                    ],
+                    /* closing any other way - backdrop, escape, the X - is a decision not to
+                       disconnect; a deferred the buttons already settled ignores this */
+                    onhide: () => {
+                        dfObj.reject();
+                    }
+                });
+
+                return dfObj;
+            },
             onAction: () => {
                 updateServiceControlUI('netbird');
                 updateNetBirdStatusUI();
diff --git a/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/settings.volt b/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/settings.volt
index 7c505a7a11..911899c965 100644
--- a/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/settings.volt
+++ b/security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/settings.volt
@@ -53,4 +53,11 @@
 <div class="content-box">
     {{ partial("layout_partials/base_form",['fields':settingsForm,'id':'frmSettings']) }}
 </div>
-{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/netbird/service/reconfigure', 'data_service_widget': 'netbird'}) }}
+{{ partial(
+    'layout_partials/base_apply_button',
+    {
+        'data_endpoint': '/api/netbird/service/reconfigure',
+        'data_service_widget': 'netbird',
+        'data_change_message_content': lang._('Apply restarts the NetBird service: the tunnel goes down and comes back up. If you are reaching this firewall through NetBird, you will lose access for a moment, so make sure you have another way in before applying.')
+    }
+) }}