diff --git a/.github/workflows/release-canary.yml b/.github/workflows/release-canary.yml
index 2f205fd59c..896d12d190 100644
--- a/.github/workflows/release-canary.yml
+++ b/.github/workflows/release-canary.yml
@@ -185,7 +185,6 @@ jobs:
           sudo snap connect openshell:docker docker:docker-daemon
           sudo snap connect openshell:log-observe
           sudo snap connect openshell:system-observe
-          sudo snap connect openshell:ssh-keys
 
       - name: Register snap gateway and check status
         run: |
diff --git a/docs/about/installation.mdx b/docs/about/installation.mdx
index ad3dcc8924..2ac077e7b9 100644
--- a/docs/about/installation.mdx
+++ b/docs/about/installation.mdx
@@ -97,7 +97,7 @@ typically `~/snap/openshell/common`. Gateway registrations live under
 ### Snap store installs
 
 When installing from the Snap Store, snapd automatically connects the `home`,
-`network`, `network-bind`, and `ssh-keys` plugs. The `docker` plug still
+`network`, and `network-bind` plugs. The `docker` plug still
 requires manual connection:
 
 ```shell
@@ -117,7 +117,6 @@ sudo snap install ./openshell_*.snap --dangerous
 sudo snap connect openshell:home
 sudo snap connect openshell:network
 sudo snap connect openshell:network-bind
-sudo snap connect openshell:ssh-keys
 sudo snap connect openshell:docker docker:docker-daemon
 sudo snap connect openshell:log-observe
 sudo snap connect openshell:system-observe
diff --git a/snapcraft.yaml b/snapcraft.yaml
index f7354aa017..d221c51e7e 100644
--- a/snapcraft.yaml
+++ b/snapcraft.yaml
@@ -27,7 +27,6 @@ description: |
          sudo snap connect openshell:docker docker:docker-daemon
          sudo snap connect openshell:log-observe
          sudo snap connect openshell:system-observe
-         sudo snap connect openshell:ssh-keys
          sudo snap start openshell.gateway
 
     3. Verify the gateway and register it locally:
@@ -69,7 +68,6 @@ apps:
     plugs:
       - home
       - network
-      - ssh-keys
       - system-observe
   term:
     command: bin/openshell term
@@ -81,7 +79,6 @@ apps:
     plugs:
       - home
       - network
-      - ssh-keys
       - system-observe
   gateway:
     command: bin/openshell-gateway-wrapper
@@ -104,7 +101,6 @@ apps:
       - log-observe
       - network
       - network-bind
-      - ssh-keys
       - system-observe
 
 parts:
@@ -150,3 +146,14 @@ parts:
         "$CRAFT_PART_INSTALL/usr/share/doc/openshell/LICENSE"
       install -D -m 0644 "$CRAFT_PART_SRC/README.md" \
         "$CRAFT_PART_INSTALL/usr/share/doc/openshell/README.md"
+
+  ssh:
+    # Vendor the openssh-client `ssh` binary into the snap so the CLI/TUI
+    # can spawn `ssh` for sandbox connect/exec/forward without relying on
+    # the host's ssh-keys interface. The binary lands at
+    # $SNAP/usr/bin/ssh and is found via the snap runtime PATH.
+    plugin: nil
+    stage-packages:
+      - openssh-client
+    prime:
+      - usr/bin/ssh