diff --git a/env.sh b/env.sh
index 42538928..936a0809 100644
--- a/env.sh
+++ b/env.sh
@@ -63,6 +63,11 @@ if [ -z "$SSH_AUTH_SOCK" ]; then
   fi
 fi
 
+if [ -x "/usr/bin/ksshaskpass" ]; then
+  export SSH_ASKPASS="/usr/bin/ksshaskpass"
+  export SSH_ASKPASS_REQUIRE="prefer"
+fi
+
 # va-api — auto-select driver based on available GPU
 if grep -q '0x1002' /sys/class/drm/card*/device/vendor 2>/dev/null; then
   export LIBVA_DRIVER_NAME=radeonsi
diff --git a/mise/conf.d/kde.toml b/mise/conf.d/kde.toml
index 1a9bf9b3..e52cecb0 100644
--- a/mise/conf.d/kde.toml
+++ b/mise/conf.d/kde.toml
@@ -6,6 +6,7 @@
 
 [bootstrap.packages]
 "dnf:kdialog" = "latest"
+"dnf:ksshaskpass" = "latest"
 "dnf:pam-kwallet" = "latest"
 "brew-cask:font-inter" = "latest"
 "brew-cask:font-iosevka-ss08" = "latest"
diff --git a/mise/conf.d/pi.toml b/mise/conf.d/pi.toml
index 7f55e776..a59b381a 100644
--- a/mise/conf.d/pi.toml
+++ b/mise/conf.d/pi.toml
@@ -1,5 +1,6 @@
 [dotfiles]
 "~/.pi/agent/settings.json" = "../../pi/settings.json"
+"~/.pi/agent/models.json" = "../../pi/models.json"
 "~/.pi/agent/themes/nord-dark.json" = "../../pi/themes/nord-dark.json"
 "~/.pi/agent/themes/nord-claude.json" = "../../pi/themes/nord-claude.json"
 
diff --git a/mise/conf.d/ssh.toml b/mise/conf.d/ssh.toml
index edf93e1f..d5cd4f90 100644
--- a/mise/conf.d/ssh.toml
+++ b/mise/conf.d/ssh.toml
@@ -1,3 +1,7 @@
+[dotfiles]
+"~/.ssh/config.d/00-machine.conf" = "../../ssh/client.conf"
+"~/.config/autostart/ssh-add.desktop" = "../../ssh/ssh-add.desktop"
+
 [bootstrap.files."/etc/ssh/sshd_config.d/01-odsod-machine.conf"]
 source = "../../ssh/machine.conf"
 owner = "root"
diff --git a/pi/models.json b/pi/models.json
new file mode 100644
index 00000000..7c7c0ae5
--- /dev/null
+++ b/pi/models.json
@@ -0,0 +1,40 @@
+{
+  "$schema": "https://pi.dev/schemas/models.schema.json",
+  "providers": {
+    "opper": {
+      "name": "Opper",
+      "baseUrl": "https://api.opper.ai/v3/compat",
+      "api": "openai-completions",
+      "apiKey": "!secret-tool lookup service opper user odsod",
+      "models": [
+        {
+          "id": "deepseek-v4.1-flash-1017",
+          "name": "DeepSeek V4.1 Flash (1017)",
+          "api": "openai-completions",
+          "reasoning": true,
+          "thinkingLevelMap": {
+            "off": "none",
+            "minimal": "minimal",
+            "low": "low",
+            "medium": "medium",
+            "high": "high",
+            "xhigh": "xhigh",
+            "max": "max"
+          },
+          "input": ["text", "image"],
+          "cost": {
+            "input": 0.2,
+            "output": 0.6,
+            "cacheRead": 0.006,
+            "cacheWrite": 0
+          },
+          "contextWindow": 1048576,
+          "maxTokens": 393216,
+          "compat": {
+            "supportsReasoningEffort": true
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/pi/settings.json b/pi/settings.json
index 968562f4..64f43307 100644
--- a/pi/settings.json
+++ b/pi/settings.json
@@ -1,10 +1,11 @@
 {
-  "defaultProvider": "opencode-go",
-  "defaultModel": "deepseek-v4.1-flash",
+  "defaultProvider": "opper",
+  "defaultModel": "deepseek-v4.1-flash-1017",
+  "modelThinkingLevels": {
+    "opper/deepseek-v4.1-flash-1017": "high"
+  },
   "theme": "nord-claude",
   "quietStartup": true,
-  "defaultTools": [
-    "+codemode"
-  ],
+  "defaultTools": ["+codemode"],
   "lastChangelogVersion": "1.3.0"
-}
\ No newline at end of file
+}
diff --git a/ssh/client.conf b/ssh/client.conf
new file mode 100644
index 00000000..a14d905f
--- /dev/null
+++ b/ssh/client.conf
@@ -0,0 +1,8 @@
+# Machine SSH client defaults
+# Included via ~/.ssh/config.d/*
+
+Host *
+  AddKeysToAgent yes
+
+Host odsod-* *.lan *.ts.net 192.168.* 100.*
+  ForwardAgent yes
diff --git a/ssh/ssh-add.desktop b/ssh/ssh-add.desktop
new file mode 100644
index 00000000..2b1a2f31
--- /dev/null
+++ b/ssh/ssh-add.desktop
@@ -0,0 +1,7 @@
+[Desktop Entry]
+Name=SSH Key Agent
+Comment=Automatically load SSH keys into ssh-agent at login using ksshaskpass
+Exec=ssh-add -q
+Type=Application
+X-KDE-autostart-after=panel
+X-KDE-StartupNotify=false