diff --git a/user/ssh/config b/user/ssh/config
index 59104eb..9aa9512 100644
--- a/user/ssh/config
+++ b/user/ssh/config
@@ -14,3 +14,10 @@ Host git.gbrown.org
     User git
     IdentityFile ~/.ssh/id_ed25519
     IdentitiesOnly yes
+
+# Agent harnesses (Claude Code, Codex) start their shells without
+# SSH_AUTH_SOCK, and id_ed25519 has a passphrase, so batch ssh from them fails
+# with "Permission denied (publickey)" even though the key is right. The
+# desktop keyring agent already holds the unlocked key; point every host at it.
+Host *
+    IdentityAgent ${XDG_RUNTIME_DIR}/keyring/ssh