diff --git a/scripts/setup/machine-setup/lib/packages.sh b/scripts/setup/machine-setup/lib/packages.sh
index 8ff1bf82..865a5e08 100644
--- a/scripts/setup/machine-setup/lib/packages.sh
+++ b/scripts/setup/machine-setup/lib/packages.sh
@@ -51,11 +51,20 @@ LAST_SKIPPED=()
 # are the environment: nothing calls them, they are here because a box you use
 # should have them.
 #
-# build-essential is the one entry with any reach beyond itself: it is a
-# meta-package (gcc, g++, make, libc6-dev, dpkg-dev), so on a machine where a
-# specific gcc was pinned it pulls the distribution's default alongside it. It
-# stays in core because anything that compiles a native module needs it, but it
-# is the one to move out first if that ever bites.
+# Two entries reach beyond simply existing on the machine.
+#
+# fail2ban is not a tool, it is a daemon: installing it starts it, and Debian and
+# Ubuntu ship an enabled sshd jail, so from that moment an address failing to log
+# in five times in ten minutes is blocked for ten. That is the point of it, and it
+# is worth having by default — but it is why it appears here rather than being
+# thought of as another binary. An existing install with its own jails is
+# untouched, because pkg_install never names a package that is already there.
+#
+# build-essential is the other: a meta-package (gcc, g++, make, libc6-dev,
+# dpkg-dev), so on a machine where a specific gcc was pinned it pulls the
+# distribution's default alongside it. It stays in core because anything that
+# compiles a native module needs it, but it is the one to move out first if that
+# ever bites.
 pkgs_core() {
   case "$PM" in
     apt)
@@ -64,15 +73,18 @@ pkgs_core() {
       # fastfetch PPA. They have no counterpart on the other systems.
       echo curl ca-certificates gnupg git jq unzip \
         apt-transport-https lsb-release software-properties-common \
-        wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools
+        wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools \
+        fail2ban
       ;;
     pacman)
       echo curl ca-certificates gnupg git jq unzip \
-        wget zip base-devel btop htop tree tmux ripgrep fd net-tools
+        wget zip base-devel btop htop tree tmux ripgrep fd net-tools \
+        fail2ban
       ;;
     dnf)
       echo curl ca-certificates gnupg2 git jq unzip \
-        wget zip btop htop tree tmux ripgrep fd-find net-tools
+        wget zip btop htop tree tmux ripgrep fd-find net-tools \
+        fail2ban
       ;;
     brew)
       # curl, unzip and the TLS roots ship with macOS; the compilers come from
diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index f3e69f0e..e9177872 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -1170,13 +1170,46 @@ elif ! skip; then
   step_ok
 fi
 
+# =============================================================================
+# 18. fail2ban
+# =============================================================================
+#
+# Installed as part of core utils rather than here — it is a distro package and
+# nothing about it needs configuring. This step only reports what it is doing,
+# because a daemon that silently blocks addresses is worth knowing is running.
+
+step "fail2ban"
+if ! skip; then
+  echo ""
+  info "fail2ban — blocks addresses that keep failing to log in"
+
+  if ! pkg_is_installed fail2ban; then
+    echo "     not installed — it is part of core utils, which was declined or skipped"
+    SUMMARY+=("fail2ban: not installed")
+  elif systemctl is-active --quiet fail2ban 2>/dev/null; then
+    echo "     running, and watching:"
+    fail2ban-client status 2>/dev/null | awk -F: '/Jail list/ { print "       " $2 }' | xargs -r echo "      "
+    echo ""
+    echo "     Ubuntu enables the sshd jail by default: five failed logins from"
+    echo "     one address within ten minutes blocks it for ten. That includes"
+    echo "     you, from wherever you are connecting."
+    echo "     Unban with:  fail2ban-client set sshd unbanip <address>"
+    SUMMARY+=("fail2ban: running")
+  else
+    warn "installed but not running"
+    echo "     start it with: systemctl enable --now fail2ban"
+    SUMMARY+=("fail2ban: installed but not running")
+  fi
+  step_ok
+fi
+
 # =============================================================================
 # NOT PORTED YET
 # =============================================================================
 #
 # Sections still to move across from scripts/setup-old/setup-ubuntu.sh, in order:
 #
-#   fail2ban · unattended-upgrades ·
+#   unattended-upgrades ·
 #   git config · docker · zsh + prompt (incl. .tmux.conf) · tailscale · neovim · js runtimes ·
 #   dev tools · ufw · zshrc
 #