diff --git a/build_sdcard.sh b/build_sdcard.sh
index 33352ea18..b53ecce44 100644
--- a/build_sdcard.sh
+++ b/build_sdcard.sh
@@ -477,6 +477,17 @@ if [ "${baseimage}" = "raspios_arm64" ]; then
   else
     echo "$fsOption2 already in $kernelOptionsFile"
   fi
+
+  # *** SAFE SHUTDOWN ***
+  # logind
+  echo "[Login]" | tee /etc/systemd/logind.conf.d/safeshutdown.conf
+  echo "HandlePowerKey=ignore" | tee -a /etc/systemd/logind.conf.d/safeshutdown.conf
+  # sudoers
+  echo 'nobody ALL=(ALL) NOPASSWD: /home/admin/config.scripts/blitz.shutdown.sh' |
+    tee -a /etc/sudoers
+  # triggerhappy
+  echo 'KEY_POWER    1    sudo /home/admin/config.scripts/blitz.shutdown.sh' |
+    tee /etc/triggerhappy/triggers.d/powerbutton.conf
 fi
 
 # special prepare when Nvidia Jetson Nano
diff --git a/home.admin/99lndRepairMenu.sh b/home.admin/99lndRepairMenu.sh
index f2e41b5c4..403be9cf6 100644
--- a/home.admin/99lndRepairMenu.sh
+++ b/home.admin/99lndRepairMenu.sh
@@ -346,7 +346,7 @@ case $CHOICE in
     echo
     echo "Press ENTER when your backup download is done to shutdown."
     read key
-    /home/admin/config.scripts/blitz.shutdown.sh
+    sudo /home/admin/config.scripts/blitz.shutdown.sh
     ;;
   RESET-LND)
     askLNDbackupCopy
diff --git a/home.admin/99updateMenu.sh b/home.admin/99updateMenu.sh
index f101ba1a8..ea75360c1 100755
--- a/home.admin/99updateMenu.sh
+++ b/home.admin/99updateMenu.sh
@@ -160,7 +160,7 @@ patch()
       if [ $? -eq 0 ]; then
         clear
         echo "REBOOT .."
-        /home/admin/config.scripts/blitz.shutdown.sh reboot
+        sudo /home/admin/config.scripts/blitz.shutdown.sh reboot
         sleep 8
         exit 1
       else
@@ -269,7 +269,7 @@ Do you really want to update LND now?
       if [ ${#error} -gt 0 ]; then
         whiptail --title "ERROR" --msgbox "${error}" 8 30
       else
-        /home/admin/config.scripts/blitz.shutdown.sh reboot
+        sudo /home/admin/config.scripts/blitz.shutdown.sh reboot
         sleep 8
       fi
       ;;
@@ -293,7 +293,7 @@ Do you really want to update LND now?
       if [ ${#error} -gt 0 ]; then
         whiptail --title "ERROR" --msgbox "${error}" 8 30
       else
-        /home/admin/config.scripts/blitz.shutdown.sh reboot
+        sudo /home/admin/config.scripts/blitz.shutdown.sh reboot
         sleep 8
       fi
       ;;
@@ -418,7 +418,7 @@ Do you really want to update Bitcoin Core now?
       error=""
       warn=""
       sudo -u admin /home/admin/config.scripts/bitcoin.update.sh tested
-      /home/admin/config.scripts/blitz.shutdown.sh reboot
+      sudo /home/admin/config.scripts/blitz.shutdown.sh reboot
       ;;
     RECKLESS)
       whiptail --title "UNTESTED Bitcoin Core update to ${bitcoinLatestVersion}" --yes-button "Cancel" \
@@ -439,11 +439,11 @@ Do you really want to update Bitcoin Core now?
       if [ ${#error} -gt 0 ]; then
         whiptail --title "ERROR" --msgbox "${error}" 8 30
       fi
-      /home/admin/config.scripts/blitz.shutdown.sh reboot
+      sudo /home/admin/config.scripts/blitz.shutdown.sh reboot
       ;;
     CUSTOM)
       sudo -u admin /home/admin/config.scripts/bitcoin.update.sh custom
-      /home/admin/config.scripts/blitz.shutdown.sh reboot
+      sudo /home/admin/config.scripts/blitz.shutdown.sh reboot
       ;;
   esac
 }
diff --git a/home.admin/_commands.sh b/home.admin/_commands.sh
index 9c2bc22bf..4bd9a7c3e 100755
--- a/home.admin/_commands.sh
+++ b/home.admin/_commands.sh
@@ -120,7 +120,7 @@ function restart() {
   echo "Command to restart your RaspiBlitz"
   confirmMsg restart
   if [ $confirm -eq 1 ]; then
-    /home/admin/config.scripts/blitz.shutdown.sh reboot
+    sudo /home/admin/config.scripts/blitz.shutdown.sh reboot
   fi
 }
 
@@ -220,7 +220,7 @@ function off() {
   echo "Command to power off your RaspiBlitz"
   confirmMsg off
   if [ $confirm -eq 1 ]; then
-    /home/admin/config.scripts/blitz.shutdown.sh
+    sudo /home/admin/config.scripts/blitz.shutdown.sh
   fi
 }
 
diff --git a/home.admin/_provision.xfinal.sh b/home.admin/_provision.xfinal.sh
index 445831e55..8f1855efa 100755
--- a/home.admin/_provision.xfinal.sh
+++ b/home.admin/_provision.xfinal.sh
@@ -35,6 +35,6 @@ sudo rm /var/cache/raspiblitz/temp/raspiblitz.setup
 sudo cp /home/admin/raspiblitz.log /home/admin/raspiblitz.setup.log
 sudo chmod 640 /home/admin/raspiblitz.setup.log
 sudo chown root:sudo /home/admin/raspiblitz.setup.log
-timeout 120 /home/admin/config.scripts/blitz.shutdown.sh reboot finalsetup
+timeout 120 sudo /home/admin/config.scripts/blitz.shutdown.sh reboot finalsetup
 # if system has not rebooted yet - force reboot directly
-sudo shutdown -r now
\ No newline at end of file
+sudo shutdown -r now
diff --git a/home.admin/config.scripts/blitz.migration.sh b/home.admin/config.scripts/blitz.migration.sh
index 2af557619..f63f72806 100755
--- a/home.admin/config.scripts/blitz.migration.sh
+++ b/home.admin/config.scripts/blitz.migration.sh
@@ -510,7 +510,7 @@ if [ "$1" = "export-gui" ]; then
   read key
   echo "Shutting down ...."
   sleep 4
-  /home/admin/config.scripts/blitz.shutdown.sh
+  sudo /home/admin/config.scripts/blitz.shutdown.sh
   exit 0
 fi
 
diff --git a/home.admin/config.scripts/blitz.shutdown.sh b/home.admin/config.scripts/blitz.shutdown.sh
index d5a4e6b23..fe1894da2 100755
--- a/home.admin/config.scripts/blitz.shutdown.sh
+++ b/home.admin/config.scripts/blitz.shutdown.sh
@@ -5,11 +5,26 @@
 # 1) give UI the info that a reboot/shutdown is now happening
 # 2) shutdown/reboot in a safe way to prevent data corruption
 
+# check if sudo
+if [ "$EUID" -ne 0 ]; then
+  echo "Please run as root (with sudo)"
+  exit 1
+fi
+
 source <(/home/admin/_cache.sh get network)
 
 # display info
-echo ""
-echo "Green activity light stays dark and LCD turns white when shutdown complete."
+echo
+rpiModel=$(cat /proc/device-tree/model 2>/dev/null | tr -d '\0')
+if [ -n "${rpiModel}" ]; then
+  echo "${rpiModel}"
+  if echo ${rpiModel} | grep -Eq 'Raspberry Pi 4'; then
+    echo "When shutdown is complete the green activity light stays dark and the LCD turns white on the ${rpiModel}."
+  elif echo ${rpiModel} | grep -Eq 'Raspberry Pi 5'; then
+    echo "When shutdown is complete the activity light turns red and the LCD turns white on the ${rpiModel}."
+  fi
+fi
+
 if [ "$1" = "reboot" ]; then
   shutdownParams="-h -r now"
   echo "It will then reboot again automatically."
@@ -26,82 +41,88 @@ fi
 echo "-----------------------------------------------"
 sleep 3
 
-# stopping electRS (if installed)
-echo "stop electrs - please wait .."
-sudo timeout 120 systemctl stop electrs 2>/dev/null
+# general services to stop
+servicesToStop="electrs fulcrum"
+for service in ${servicesToStop}; do
+  if systemctl is-active --quiet ${service}; then
+    echo "stopping ${service} - please wait .."
+    timeout 120 systemctl stop ${service}
+  fi
+done
 
+# lndg
 # stopping LNDg (if installed)
 isInstalled=$(sudo ls /etc/systemd/system/jobs-lndg.service 2>/dev/null | grep -c 'jobs-lndg.service')
 if ! [ ${isInstalled} -eq 0 ]; then
   echo "stop LNDg - please wait .."
-  sudo timeout 120 systemctl stop gunicorn.service 2>/dev/null
-  sudo timeout 120 systemctl stop jobs-lndg.timer 2>/dev/null
-  sudo timeout 120 systemctl stop jobs-lndg.service 2>/dev/null
-  sudo timeout 120 systemctl stop rebalancer-lndg.timer 2>/dev/null
-  sudo timeout 120 systemctl stop rebalancer-lndg.service 2>/dev/null
-  sudo timeout 120 systemctl stop htlc-stream-lndg.service 2>/dev/null
+  timeout 120 systemctl stop gunicorn.service 2>/dev/null
+  timeout 120 systemctl stop jobs-lndg.timer 2>/dev/null
+  timeout 120 systemctl stop jobs-lndg.service 2>/dev/null
+  timeout 120 systemctl stop rebalancer-lndg.timer 2>/dev/null
+  timeout 120 systemctl stop rebalancer-lndg.service 2>/dev/null
+  timeout 120 systemctl stop htlc-stream-lndg.service 2>/dev/null
 fi
 
-# stopping lightning
-echo "stop lightning - please wait .."
-sudo timeout 120 systemctl stop lnd 2>/dev/null
-sudo timeout 120 systemctl stop lightningd 2>/dev/null
-sudo timeout 120 systemctl stop tlnd 2>/dev/null
-sudo timeout 120 systemctl stop tlightningd 2>/dev/null
-sudo timeout 120 systemctl stop slnd 2>/dev/null
-sudo timeout 120 systemctl stop slightningd 2>/dev/null
+# lightning
+lightningServicesToStop="lnd tlnd slnd lightningd tlightningd slightningd"
+for service in ${lightningServicesToStop}; do
+  if systemctl is-active --quiet ${service}; then
+    echo "stopping ${service} - please wait .."
+    timeout 120 systemctl stop ${service}
+  fi
+done
 
+# bitcoind
 if [ "${network}" != "" ]; then
-
   # stopping bitcoin (thru cli)
   echo "stop ${network}d (1) - please wait .."
   timeout 10 sudo -u bitcoin ${network}-cli stop 2>/dev/null
 
   # stopping bitcoind (thru systemd)
   echo "stop ${network}d (2) - please wait .."
-  sudo timeout 120 systemctl stop ${network}d 2>/dev/null
-  sudo timeout 120 systemctl stop t${network}d 2>/dev/null
-  sudo timeout 120 systemctl stop s${network}d 2>/dev/null
+  timeout 120 systemctl stop ${network}d 2>/dev/null
+  timeout 120 systemctl stop t${network}d 2>/dev/null
+  timeout 120 systemctl stop s${network}d 2>/dev/null
   sleep 3
 else
   echo "skipping stopping layer1 (network=='' in cache)"
 fi
 
 # make sure drives are synced before shutdown
-source <(sudo /home/admin/config.scripts/blitz.datadrive.sh status)
+source <(/home/admin/config.scripts/blitz.datadrive.sh status)
 if [ "${isBTRFS}" == "1" ] && [ "${isMounted}" == "1" ]; then
   echo "STARTING BTRFS RAID DATA CHECK ..."
-  sudo btrfs scrub start /mnt/hdd/
+  btrfs scrub start /mnt/hdd/
 fi
 sync
 
 # unmount HDD - try to kill all processes first #3114
 echo "# Killing the processes using /mnt/hdd"
-processesUsingDisk=$(sudo lsof -t "/mnt/hdd")
+processesUsingDisk=$(lsof -t "/mnt/hdd")
 if [ -n "$processesUsingDisk" ]; then
   while read -r pid; do
     processName=$(ps -p $pid -o comm=)
     echo "# Stop $processName with: 'kill -SIGTERM $pid'"
-    sudo kill -SIGTERM $pid # Send SIGTERM signal
-    sleep 5                 # Wait for the process to terminate
-  done <<< "$processesUsingDisk"
+    kill -SIGTERM $pid # Send SIGTERM signal
+    sleep 5            # Wait for the process to terminate
+  done <<<"$processesUsingDisk"
 fi
 
 echo "# Attempt to unmount /mnt/hdd"
-sudo umount "/mnt/hdd"
+umount "/mnt/hdd"
 
 echo "starting shutdown ..."
-sudo shutdown ${shutdownParams}
+shutdown ${shutdownParams}
 
 # detect missing DBUS
 if [ "${DBUS_SESSION_BUS_ADDRESS}" == "" ]; then
   echo "WARN: Missing \$DBUS_SESSION_BUS_ADDRESS .. "
   if [ "$1" = "reboot" ]; then
     echo "RUNNING FALLBACK REBOOT .. "
-    sudo systemctl --force --force reboot
+    systemctl --force --force reboot
   else
     echo "RUNNING FALLBACK SHUTDOWN .. "
-    sudo systemctl --force --force poweroff
+    systemctl --force --force poweroff
   fi
 fi