diff --git a/ssh/server.go b/ssh/server.go
index e0e8890..480eb6b 100644
--- a/ssh/server.go
+++ b/ssh/server.go
@@ -476,12 +476,14 @@ func checkSourceAddress(addr net.Addr, sourceAddrs string) error {
 
 // checkSourceAddressCriticalOption enforces the source-address critical
 // option, if present in perms, as documented in Permissions.CriticalOptions.
+// A present but empty value matches no address, so it denies authentication,
+// consistently with OpenSSH, rather than being treated as absent.
 func checkSourceAddressCriticalOption(addr net.Addr, perms *Permissions) error {
 	if perms == nil {
 		return nil
 	}
-	saco := perms.CriticalOptions[sourceAddressCriticalOption]
-	if saco == "" {
+	saco, ok := perms.CriticalOptions[sourceAddressCriticalOption]
+	if !ok {
 		return nil
 	}
 	return checkSourceAddress(addr, saco)
diff --git a/ssh/server_test.go b/ssh/server_test.go
index c44cdcf..81ebd1e 100644
--- a/ssh/server_test.go
+++ b/ssh/server_test.go
@@ -819,6 +819,7 @@ func TestAuthCallbacksSourceAddress(t *testing.T) {
 		}{
 			{"mismatching", "192.168.99.99", true},
 			{"matching", "127.0.0.0/8,::1/128", false},
+			{"present but empty", "", true},
 		} {
 			t.Run(method.name+"/"+tc.name, func(t *testing.T) {
 				clientConf := &ClientConfig{