diff --git a/CHANGELOG.md b/CHANGELOG.md
index cae8d94..4a6eb14 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,20 @@ The **patch** part changes is incremented if multiple releases happen the same m
 
 ### Added
 
+### Changed
+
+### Fixed
+
+### Removed
+
+### Security
+
+
+
+## [24.04]
+
+### Added
+
 * Prevent op_del to fail and able to remove web account when part of it is already removed
 
 ### Changed
@@ -21,6 +35,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ### Fixed
 
 * letsencrypt: Add required check when retrieving certificate. (Avoid TypeError.)
+* web-add.sh: Fix ssh group membership (#94)
 
 ### Removed
 
diff --git a/scripts/web-add.sh b/scripts/web-add.sh
index 5ec23ba..27013e0 100755
--- a/scripts/web-add.sh
+++ b/scripts/web-add.sh
@@ -14,7 +14,7 @@
 
 set -e
 
-VERSION="23.02"
+VERSION="24.04"
 HOME="/root"
 CONTACT_MAIL="jdoe@example.org"
 WWWBOUNCE_MAIL="jdoe@example.org"
@@ -363,14 +363,12 @@ create_www_account() {
         lxc-attach -n php"${php_version}" -- /usr/sbin/adduser --disabled-password --home "$HOME_DIR_USER"/www --no-create-home --shell /bin/false --gecos "WWW $in_login" www-"$in_login" --uid "$www_uid" --ingroup "$in_login" --force-badname >/dev/null
     done
 
-    if grep -qE '^AllowGroups' /etc/ssh/sshd_config; then
-        if ! grep -qE "^AllowGroups(\\s+\\S+)*(\\s+$SSH_GROUP)" /etc/ssh/sshd_config; then
-            sed -i "s/^AllowGroups .*/& $SSH_GROUP/" /etc/ssh/sshd_config
-            groupadd --force $SSH_GROUP
-        fi
-        usermod -a -G $SSH_GROUP "$in_login"
-    elif grep -qE '^AllowUsers' /etc/ssh/sshd_config; then
+    if grep -qE '^AllowUsers' /etc/ssh/sshd_config; then
         sed -i "s/^AllowUsers .*/& $in_login/" /etc/ssh/sshd_config
+    else
+        if getent group "$SSH_GROUP" 1>/dev/null 2>&1; then
+            usermod --append --groups "$SSH_GROUP" "$in_login"
+	fi
     fi
     /etc/init.d/ssh reload