diff --git a/sql/migrations/010_iodine_opt_in.sql b/sql/migrations/010_iodine_opt_in.sql
new file mode 100644
index 0000000..9dd1e0b
--- /dev/null
+++ b/sql/migrations/010_iodine_opt_in.sql
@@ -0,0 +1,3 @@
+-- Add iodine to remote access opt_in_mode (MariaDB).
+ALTER TABLE remote_access_devices
+    MODIFY opt_in_mode ENUM('none','wireguard','rssh','iodine') NOT NULL DEFAULT 'none';
diff --git a/src/RemoteAccessRepository.php b/src/RemoteAccessRepository.php
index 6739920..5f68bb7 100644
--- a/src/RemoteAccessRepository.php
+++ b/src/RemoteAccessRepository.php
@@ -9,6 +9,7 @@ final class RemoteAccessRepository {
     public const OPT_NONE = 'none';
     public const OPT_WIREGUARD = 'wireguard';
     public const OPT_RSSH = 'rssh';
+    public const OPT_IODINE = 'iodine';
 
     public const STATUS_PENDING = 'pending';
     public const STATUS_ACTIVE = 'active';
@@ -243,9 +244,12 @@ final class RemoteAccessRepository {
             if ($c === 'ssh_reverse' || $c === 'rssh') {
                 return self::OPT_RSSH;
             }
+            if ($c === 'iodine') {
+                return self::OPT_IODINE;
+            }
         }
         $mode = strtolower(trim((string) ($heartbeat['tunnel_mode'] ?? '')));
-        if (in_array($mode, [self::OPT_WIREGUARD, self::OPT_RSSH, self::OPT_NONE], true)) {
+        if (in_array($mode, [self::OPT_WIREGUARD, self::OPT_RSSH, self::OPT_IODINE, self::OPT_NONE], true)) {
             return $mode;
         }
         return self::OPT_WIREGUARD;
@@ -614,7 +618,7 @@ final class RemoteAccessRepository {
             return ['ok' => false, 'error' => 'device_not_opted_in'];
         }
         $optIn = (string) ($device['opt_in_mode'] ?? self::OPT_NONE);
-        if (!in_array($optIn, [self::OPT_WIREGUARD, self::OPT_RSSH], true)) {
+        if (!in_array($optIn, [self::OPT_WIREGUARD, self::OPT_RSSH, self::OPT_IODINE], true)) {
             return ['ok' => false, 'error' => 'device_not_opted_in'];
         }
         self::closeActiveSessionsForDevice($deviceId, 'superseded');