diff --git a/lyrathorpe/home/shell.nix b/lyrathorpe/home/shell.nix
index 385ede8..9236917 100644
--- a/lyrathorpe/home/shell.nix
+++ b/lyrathorpe/home/shell.nix
@@ -224,6 +224,15 @@
     extraConfig = lib.optionalString pkgs.stdenv.hostPlatform.isDarwin ''
       UseKeychain yes
     '';
+    # Gitea remote (the flake's origin) -- required on every host. Pins the
+    # dedicated key so the right identity is offered. identitiesOnly avoids
+    # "too many authentication failures" when the agent holds several keys.
+    matchBlocks."code.emmathe.dev" = {
+      user = "git";
+      port = 30009; # Gitea listens on a non-default SSH port
+      identityFile = "~/.ssh/code.emmathe.dev";
+      identitiesOnly = true;
+    };
   };
 
   # Run a user ssh-agent on Linux (macOS provides one via launchd). EDaaS also