diff --git a/.gitea/workflows/deploy-neuro.yaml b/.gitea/workflows/deploy-neuro.yaml
index 80609dae..188041b8 100644
--- a/.gitea/workflows/deploy-neuro.yaml
+++ b/.gitea/workflows/deploy-neuro.yaml
@@ -60,6 +60,7 @@ jobs:
             > "$ssh_home/.ssh/config"
           chmod 600 "$ssh_home/.ssh/config"
           export HOME="$ssh_home"
+          export HECTIC_DEPLOY_SSH_CONFIG="$HOME/.ssh/config"
           export NIX_SSHOPTS="-F $HOME/.ssh/config -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519"
           ssh -F "$HOME/.ssh/config" -o BatchMode=yes -o ConnectTimeout=10 \
             -o StrictHostKeyChecking=yes \
diff --git a/package/deploy/deploy.sh b/package/deploy/deploy.sh
index 5650058c..27a91a19 100644
--- a/package/deploy/deploy.sh
+++ b/package/deploy/deploy.sh
@@ -9,10 +9,13 @@ HECTIC_NAMESPACE="deploy"
 puressh() {
   local known_hosts="${HECTIC_DEPLOY_KNOWN_HOSTS:-$HOME/.ssh/known_hosts}"
   local identity_file="${HECTIC_DEPLOY_IDENTITY_FILE:-$HOME/.ssh/id_ed25519}"
-  # shellcheck disable=SC2068
+  local ssh_config="${HECTIC_DEPLOY_SSH_CONFIG:-}"
+  if [ -n "$ssh_config" ]; then
+    set -- -F "$ssh_config" "$@"
+  fi
   ssh -o BatchMode=yes -o StrictHostKeyChecking=yes \
     -o UserKnownHostsFile="$known_hosts" -o IdentitiesOnly=yes \
-    -i "$identity_file" $@
+    -i "$identity_file" "$@"
 }
 
 # echo <gens_list> | find_older_gen(gen)