diff --git a/modules/home.nix b/modules/home.nix
index b7ab9c0..171c7d0 100644
--- a/modules/home.nix
+++ b/modules/home.nix
@@ -9,6 +9,16 @@ let
   terminal = "foot";
   browser = "librewolf";
   editor = "nvim";
+
+  # SSH_ASKPASS helper that drives the GPG pinentry-qt: ssh passphrase/PIN
+  # prompts reuse the same Qt dialog as commit signing, adding no extra GUI
+  # toolkit (a packaged askpass would drag in KDE/GTK — hundreds of MB).
+  sshAskpass = pkgs.writeShellScript "ssh-askpass-pinentry" ''
+    desc=$(printf '%s' "''${1:-Passphrase:}" | sed 's/%/%25/g')
+    printf 'SETTITLE ssh\nSETPROMPT PIN:\nSETDESC %s\nGETPIN\nBYE\n' "$desc" \
+      | ${pkgs.pinentry-qt}/bin/pinentry-qt \
+      | sed -n 's/^D //p'
+  '';
 in
 {
   imports = [ ./gpg.nix ./media.nix ];
@@ -36,10 +46,10 @@ in
     # Mute the harmless "Wayland does not support QWindow::requestActivate()"
     # spam Qt apps (keepassxc) print; scoped to that one log category only.
     QT_LOGGING_RULES = "qt.qpa.wayland=false";
-    # GUI helper for ssh passphrase/PIN prompts. Not forced: with a tty ssh still
-    # prompts inline; the helper is only used when a caller sets
-    # SSH_ASKPASS_REQUIRE (e.g. a headless/agent context).
-    SSH_ASKPASS = "${pkgs.ksshaskpass}/bin/ksshaskpass";
+    # GUI helper for ssh passphrase/PIN prompts (see sshAskpass above). Not
+    # forced: with a tty ssh still prompts inline; the helper is used only when a
+    # caller sets SSH_ASKPASS_REQUIRE (e.g. a headless/agent context).
+    SSH_ASKPASS = "${sshAskpass}";
   };
   # Sets XDG_{CONFIG,DATA,CACHE}_HOME and enables xdg.configFile management.
   xdg.enable = true;
@@ -53,7 +63,6 @@ in
     nodejs
     highlight   # `ccat` alias: syntax-highlighted cat
     libreoffice
-    ksshaskpass   # Qt GUI prompt for ssh passphrase/PIN (see SSH_ASKPASS above)
   ];
 
   # ---- Per-tool config files, routed into XDG dirs ---------------------