diff --git a/docker-compose-files/forgejo/.env.sample b/docker-compose-files/forgejo/.env.sample
index ebb1339..d663ba2 100644
--- a/docker-compose-files/forgejo/.env.sample
+++ b/docker-compose-files/forgejo/.env.sample
@@ -13,6 +13,11 @@ FORGEJO_MEM_LIMIT=1G
 FORGEJO_ROOT_URL=https://git.home.example.com
 FORGEJO_DOMAIN=git.home.example.com
 
+# Hostname shown in the web UI's SSH clone URL. Must resolve directly to
+# this LXC (not through Caddy — SSH can't be proxied), so it needs its own
+# DNS A record rather than reusing FORGEJO_DOMAIN's wildcard CNAME to Caddy.
+FORGEJO_SSH_DOMAIN=forgejo.home.example.com
+
 # Generate with: openssl rand -base64 32
 FORGEJO_DB_PASSWORD=<random-secret>
 
diff --git a/docker-compose-files/forgejo/template.yaml b/docker-compose-files/forgejo/template.yaml
index 45b7532..ad932e6 100644
--- a/docker-compose-files/forgejo/template.yaml
+++ b/docker-compose-files/forgejo/template.yaml
@@ -67,6 +67,12 @@ services:
       FORGEJO__database__PASSWD: "{{FORGEJO_DB_PASSWORD}}"
       FORGEJO__server__ROOT_URL: "{{FORGEJO_ROOT_URL}}"
       FORGEJO__server__DOMAIN: "{{FORGEJO_DOMAIN}}"
+      # SSH_DOMAIN drives the SSH clone URL shown in the web UI. It defaults
+      # to "localhost" (not DOMAIN), which is unusable here regardless: SSH
+      # can't be proxied through Caddy, so FORGEJO_DOMAIN's wildcard CNAME
+      # to the Caddy host would be wrong too. Point it at a dedicated DNS
+      # record resolving directly to this LXC instead (see README).
+      FORGEJO__server__SSH_DOMAIN: "{{FORGEJO_SSH_DOMAIN}}"
       FORGEJO__server__SSH_PORT: "{{FORGEJO_SSH_PORT:-2222}}"
       # LANDING_PAGE controls what anonymous visitors see at "/" — set to
       # login so they land on sign-in instead of the marketing homepage.