diff --git a/modules/services/firewall.nix b/modules/services/firewall.nix
index 39a069e..0104880 100644
--- a/modules/services/firewall.nix
+++ b/modules/services/firewall.nix
@@ -1,5 +1,13 @@
 { ... }:
 {
   networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 80 443 4430 4431 8443 ];
+  networking.firewall.allowedTCPPorts = [
+    22
+    80
+    443
+    2222
+    4430
+    4431
+    8443
+  ];
 }
diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index a8f1a89..2a4ecbe 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -14,7 +14,11 @@ in
         ROOT_URL = "https://${domain}/";
         HTTP_ADDR = "127.0.0.1";
         HTTP_PORT = port;
-        DISABLE_SSH = true; # HTTPS-only git access
+        # Git-over-SSH via Forgejo's built-in server on a dedicated port.
+        START_SSH_SERVER = true;
+        SSH_PORT = 2222; # advertised in clone URLs
+        SSH_LISTEN_PORT = 2222; # built-in server listen port
+        # SSH_DOMAIN defaults to DOMAIN (code.randogoth.com)
       };
       service = {
         DISABLE_REGISTRATION = true; # admin creates accounts
@@ -26,6 +30,17 @@ in
     };
   };
 
+  # System-wide SSH client config so root (the nix daemon) can fetch the private
+  # Forgejo flake inputs, mirroring the Codeberg block in webhook-deploy.nix.
+  # Reuses the existing /etc/ssh/codeberg_id_ed25519 deploy key (its public half
+  # is registered on the randogoth Forgejo account).
+  programs.ssh.extraConfig = ''
+    Host ${domain}
+      Port 2222
+      IdentityFile /etc/ssh/codeberg_id_ed25519
+      StrictHostKeyChecking accept-new
+  '';
+
   # Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
   environment.etc."caddy/Caddyfile.d/forgejo.caddyfile".text = ''
     ${domain} {