diff --git a/home/modules/deploy/colmena-wrapper.bash b/home/modules/deploy/colmena-wrapper.bash
index a38ae78d..85b245c0 100644
--- a/home/modules/deploy/colmena-wrapper.bash
+++ b/home/modules/deploy/colmena-wrapper.bash
@@ -1,6 +1,6 @@
 # `colmena` wrapper script that opens a short-lived SSH master process for
 # `colmena` to use so it works with hardware-backed key touch+PIN. assumes
-# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+# ControlPath ~/.ssh/control/%C (see ../ssh/default.nix)
 
 selector=""
 want_on=0
diff --git a/home/modules/deploy/default.nix b/home/modules/deploy/default.nix
index 62647471..33cae319 100644
--- a/home/modules/deploy/default.nix
+++ b/home/modules/deploy/default.nix
@@ -61,16 +61,5 @@ in
       colmenaWrapped
       deployRsWrapped
     ];
-    programs.ssh.settings = lib.genAttrs hostsWithKeys (
-      hostname:
-      let
-        meta = myUtils.hostMeta (hostDir + "/${hostname}");
-      in
-      {
-        User = meta.host.username;
-        HostName = hostname;
-        ControlPath = "~/.ssh/socket-%r@%h:%p";
-      }
-    );
   };
 }
diff --git a/home/modules/deploy/deploy-rs-wrapper.bash b/home/modules/deploy/deploy-rs-wrapper.bash
index fc98be63..7cdc31c2 100644
--- a/home/modules/deploy/deploy-rs-wrapper.bash
+++ b/home/modules/deploy/deploy-rs-wrapper.bash
@@ -1,6 +1,6 @@
 # `deploy` wrapper script that opens a short-lived SSH master process for
 # `deploy-rs` to use so it works with hardware-backed key touch+PIN. assumes
-# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+# ControlPath ~/.ssh/control/%C (see ../ssh/default.nix)
 
 # extract the target host from the `deploy-rs` flake target (e.g. `.#hecuba`)
 node=""
diff --git a/home/modules/ssh/default.nix b/home/modules/ssh/default.nix
index f4c11f7d..7d7ce771 100644
--- a/home/modules/ssh/default.nix
+++ b/home/modules/ssh/default.nix
@@ -2,11 +2,17 @@
   config,
   lib,
   pkgs,
+  myUtils,
   ...
 }:
 
 let
   cfg = config.ssh;
+
+  hostDir = ../../../hosts;
+  hostsWithKeys = lib.filter (hostname: builtins.pathExists (hostDir + "/${hostname}/ssh_host.pub")) (
+    myUtils.dirNames hostDir
+  );
 in
 {
   options.ssh.enable = lib.mkEnableOption "ssh";
@@ -14,6 +20,8 @@ in
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [ sshfs ];
 
+    home.file.".ssh/control/.keep".text = "";
+
     services.ssh-agent.enable = true;
 
     systemd.user.services.ssh-agent.Service.Environment = [
@@ -25,16 +33,31 @@ in
       enable = true;
       enableDefaultConfig = false;
 
-      settings = {
-        "*" = {
-          AddKeysToAgent = "yes";
-          ForwardAgent = false;
-          identityFile = [
-            "~/.ssh/id_ed25519_sk"
-            "~/.ssh/id_ed25519_sk_bak"
-          ];
+      settings =
+        lib.genAttrs hostsWithKeys (
+          hostname:
+          let
+            meta = myUtils.hostMeta (hostDir + "/${hostname}");
+          in
+          {
+            User = meta.host.username;
+            HostName = hostname;
+          }
+        )
+        // {
+          "*" = {
+            AddKeysToAgent = "yes";
+            ForwardAgent = false;
+            identityFile = [
+              "~/.ssh/id_ed25519_sk"
+              "~/.ssh/id_ed25519_sk_bak"
+            ];
+            IdentitiesOnly = true;
+            ControlMaster = "auto";
+            ControlPath = "~/.ssh/control/%C";
+            ControlPersist = "10m";
+          };
         };
-      };
     };
   };
 }