diff --git a/modules/home.nix b/modules/home.nix
index 41e3b1f..33a19fd 100644
--- a/modules/home.nix
+++ b/modules/home.nix
@@ -547,6 +547,12 @@ in
   # session has none otherwise; apps using libsecret/qtkeychain need it.
   services.gnome-keyring.enable = true;
 
+  # ssh-agent user service; sets SSH_AUTH_SOCK so `ssh-add` works in any shell.
+  # gnome-keyring above no longer ships an ssh component (dropped upstream), and
+  # gpg's ssh support is off, so this is the only agent. Keys are added on
+  # demand — nothing here presumes a particular ssh config.
+  services.ssh-agent.enable = true;
+
   services.mako = {
     enable = true;
     settings = {