diff --git a/devices.toml b/devices.toml
index 77ff51b..cb11f8a 100644
--- a/devices.toml
+++ b/devices.toml
@@ -21,3 +21,9 @@ mac = "f0:a7:31:6c:50:4b"
 name = "camera-bedroom"
 ip = "10.0.0.39"
 note = "go2rtc / RTSP source. isolated=true was reverted: it also cut the vendor cloud tunnel the phone app needs from outside the house."
+
+[[device]]
+mac = "74:56:3c:42:9d:a3"
+name = "FredOS-Gaming"
+ip = "10.0.0.20"
+note = "Fixed so the server can `ssh gaming` (hosts/FredOS-Gaming.nix)."
diff --git a/hosts/FredOS-Gaming.nix b/hosts/FredOS-Gaming.nix
index 65e872f..ae677f1 100644
--- a/hosts/FredOS-Gaming.nix
+++ b/hosts/FredOS-Gaming.nix
@@ -45,6 +45,20 @@
     nix.settings.max-jobs = 1;
     nix.settings.builders-use-substitutes = true;
 
+    # Lets the server (`ssh gaming` there, 10.0.0.20 reserved in devices.toml)
+    # in for remote fixes. LAN only: nothing in ports.toml forwards to it.
+    services.openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+    users.users.fred.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMbIdOSPjnJYQ7z7n0mHKo8T8PnAkCyIBCmT4KpsHyy/ fred@FredOS-Mediaserver"
+    ];
+
     programs.steam = {
       enable = true;
       remotePlay.openFirewall = true;
diff --git a/hosts/FredOS-Mediaserver.nix b/hosts/FredOS-Mediaserver.nix
index 29ce8cd..99ed985 100644
--- a/hosts/FredOS-Mediaserver.nix
+++ b/hosts/FredOS-Mediaserver.nix
@@ -42,6 +42,11 @@
         Port 2222
         HostKeyAlias FredOS-Eee
         StrictHostKeyChecking accept-new
+
+      Host gaming
+        HostName 10.0.0.20
+        HostKeyAlias FredOS-Gaming
+        StrictHostKeyChecking accept-new
     '';
 
     # Basic system packages