diff --git a/home/default.nix b/home/default.nix
index 9bbd28e..33915ee 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -3,8 +3,10 @@
   imports = [
     ./cli.nix
     ./git.nix
+    ./ssh.nix
     ./zsh.nix
     ./duti.nix
+    ./pass.nix
   ];
 
   home.stateVersion = "24.11";
diff --git a/home/pass.nix b/home/pass.nix
index 4881591..7097f58 100644
--- a/home/pass.nix
+++ b/home/pass.nix
@@ -6,22 +6,60 @@
     package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
     settings = {
       PASSWORD_STORE_DIR = "$HOME/.password-store";
-      PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git";
+      PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/password-store.git";
       PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
       PASSWORD_STORE_CLIP_TIME = "45";
       PASSWORD_STORE_GENERATED_LENGTH = "25";
     };
   };
 
-  # Activation: ensure GPG key is available
-  # TODO: figure out why home.activation.data fails with multi-line strings
-  # For now, run pass setup manually after first activation
-
-
   # GPG agent settings
   services.gpg-agent = {
     enable = true;
     defaultCacheTtl = 3600;
     enableSshSupport = true;
   };
+
+  # Activation: setup pass git origins (forgejo + github + sol.moe)
+  # Uses pkgs.writeShellScript to avoid home.activation.data string issues
+  home.activation.passOrigins = {
+    data = let
+      setupScript = pkgs.writeShellScript "pass-origins-setup" ''
+        set -e
+        
+        # Initialize pass if not yet
+        if [ ! -d "$HOME/.password-store" ]; then
+          echo "Initializing pass store..."
+          mkdir -p "$HOME/.password-store"
+        fi
+        
+        # Initialize git if not yet
+        if [ ! -d "$HOME/.password-store/.git" ]; then
+          cd "$HOME/.password-store"
+          ${pkgs.git}/bin/git init -q
+        fi
+        
+        cd "$HOME/.password-store"
+        
+        # Add origin (forgejo) if not present
+        if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then
+          ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git"
+        fi
+        
+        # Add github remote if not present
+        if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then
+          ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git"
+        fi
+        
+        # Add git.sol.moe remote if not present
+        if ! ${pkgs.git}/bin/git remote get-url git.sol.moe >/dev/null 2>&1; then
+          ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git"
+        fi
+        
+        cd - >/dev/null
+      '';
+    in builtins.toFile "pass-origins.sh" ''
+      ${setupScript}
+    '';
+  };
 }
diff --git a/home/ssh.nix b/home/ssh.nix
new file mode 100644
index 0000000..36e719b
--- /dev/null
+++ b/home/ssh.nix
@@ -0,0 +1,32 @@
+{ ... }:
+{
+  # SSH client configuration with host-specific keys
+  programs.ssh = {
+    enable = true;
+    
+    matchBlocks = {
+      # Forgejo (personal) — port 2222
+      "git.iscg.dev" = {
+        identityFile = "~/.ssh/id_ed25519_forgejo";
+        port = 2222;
+        identitiesOnly = true;
+        addKeysToAgent = "yes";
+      };
+      
+      # GitHub
+      "github.com" = {
+        identityFile = "~/.ssh/id_ed25519";
+        identitiesOnly = true;
+        addKeysToAgent = "yes";
+      };
+      
+      # git.sol.moe
+      "git.sol.moe" = {
+        identityFile = "~/.ssh/poppy";
+        user = "mikl";
+        identitiesOnly = true;
+        addKeysToAgent = "yes";
+      };
+    };
+  };
+}
diff --git a/home/zsh.nix b/home/zsh.nix
index 9fb980b..3efdbea 100644
--- a/home/zsh.nix
+++ b/home/zsh.nix
@@ -49,6 +49,10 @@
       pass-sync = "pass git push";
       pass-pull = "pass git pull";
       pass-status = "pass git status";
+      pass-sync-forgejo = "pass git push origin";
+      pass-sync-github = "pass git push github";
+      pass-sync-solmoe = "pass git push git.sol.moe";
+      pass-pull-all = "pass git pull --all";
     };
 
     # Environment setup (zshenv)