diff --git a/tools/otci/otci/command_handlers.py b/tools/otci/otci/command_handlers.py
index aaca3b327..582bcef57 100644
--- a/tools/otci/otci/command_handlers.py
+++ b/tools/otci/otci/command_handlers.py
@@ -174,25 +174,36 @@ class OtCliCommandRunner(OTCommandHandler):
 
 class OtbrSshCommandRunner(OTCommandHandler):
 
-    def __init__(self, host, port, username, password):
+    def __init__(self, host, port, username, password, sudo):
         import paramiko
 
         self.__host = host
         self.__port = port
+        self.__sudo = sudo
         self.__ssh = paramiko.SSHClient()
         self.__ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-        self.__ssh.connect(host,
-                           port=port,
-                           username=username,
-                           password=password,
-                           allow_agent=False,
-                           look_for_keys=False)
+
+        try:
+            self.__ssh.connect(host,
+                               port=port,
+                               username=username,
+                               password=password,
+                               allow_agent=False,
+                               look_for_keys=False)
+        except paramiko.ssh_exception.AuthenticationException:
+            if not password:
+                self.__ssh.get_transport().auth_none(username)
+            else:
+                raise
 
     def __repr__(self):
         return f'{self.__host}:{self.__port}'
 
     def execute_command(self, cmd: str, timeout: float) -> List[str]:
-        sh_cmd = f'sudo ot-ctl "{cmd}"'
+        sh_cmd = f'ot-ctl -- {cmd}'
+        if self.__sudo:
+            sh_cmd = 'sudo ' + sh_cmd
+
         cmd_in, cmd_out, cmd_err = self.__ssh.exec_command(sh_cmd, timeout=int(timeout), bufsize=1024)
         err = cmd_err.read().decode('utf-8')
         if err:
diff --git a/tools/otci/otci/otci.py b/tools/otci/otci/otci.py
index 7a8397747..727770fd8 100644
--- a/tools/otci/otci/otci.py
+++ b/tools/otci/otci/otci.py
@@ -2380,8 +2380,8 @@ def connect_ncp_sim(executable: str, nodeid: int, simulator: Optional[Simulator]
     return OTCI(cmd_handler)
 
 
-def connect_otbr_ssh(host: str, port: int = 22, username='pi', password='raspberry'):
-    cmd_handler = OtbrSshCommandRunner(host, port, username, password)
+def connect_otbr_ssh(host: str, port: int = 22, username='pi', password='raspberry', sudo=True):
+    cmd_handler = OtbrSshCommandRunner(host, port, username, password, sudo=sudo)
     return OTCI(cmd_handler)