diff --git a/.env.sample b/.env.sample
index 90889a6..b95d121 100644
--- a/.env.sample
+++ b/.env.sample
@@ -51,8 +51,8 @@ GITEA_REPO_UPLOAD_MAX_FILES=5
 GITEA_MAILER_FROM=noreply@example.com
 GITEA_MAILER_USER=noreply@example.com
 
-GITEA_SSH_PORT=2222
-GITEA_SSH_ENABLED=1
+# SSH Support
+COMPOSE_FILE="$COMPOSE_FILE:compose.ssh.yml"
 
 SECRET_INTERNAL_TOKEN_VERSION=v1 # length=105
 SECRET_DB_PASSWORD_VERSION=v1
diff --git a/README.md b/README.md
index 3fcd575..fe9144e 100644
--- a/README.md
+++ b/README.md
@@ -52,15 +52,13 @@ abra app deploy YOURTRAEFIKAPP
 ```
 You might need to wait a bit.  To check if it worked, you can run
 ```
-telnet my.gitea.example.com 2222
+telnet my.forgejo.example.com 2222
 ```
-Once you have added a public SSH key, you can check that you can connect to your gitea server with
+Once you have added a public SSH key, you can check that you can connect to your Forgejo server with
 ```
-ssh -T -p 2222 git@my.gitea.example.com
+ssh -T -p 2222 git@my.forgejo.example.com
 ```
 
-Note that gitea should be configured to listen to port 2222, i.e. `GITEA_SSH_PORT=2222` in the gitea config.
-
 ## Protect Forgejo from scrapers with Anubis
 
 Uncomment the Anubis compose file from the `.env` file and re-deploy the
diff --git a/abra.sh b/abra.sh
index cf7461f..4bf51e7 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,4 +1,4 @@
-export APP_INI_VERSION=v26
+export APP_INI_VERSION=v27
 export DOCKER_SETUP_SH_VERSION=v1
 export PG_BACKUP_VERSION=v1
 
diff --git a/app.ini.tmpl b/app.ini.tmpl
index 94cd6f8..40b50a7 100644
--- a/app.ini.tmpl
+++ b/app.ini.tmpl
@@ -75,9 +75,10 @@ DOMAIN = {{ env "GITEA_DOMAIN" }}
 LANDING_PAGE = {{ env "GITEA_LANDING_PAGE" }}
 ROOT_URL = https://%(DOMAIN)s/
 SSH_DOMAIN = {{ env "GITEA_DOMAIN" }}
-SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
-SSH_PORT = {{ env "GITEA_SSH_PORT" }}
-START_SSH_SERVER = true
+SSH_LISTEN_PORT = 2222
+SSH_PORT = 2222
+START_SSH_SERVER = {{ env "GITEA_SSH_ENABLED" }}
+DISABLE_SSH = {{ if eq (env "GITEA_SSH_ENABLED") "true" }}false{{ else }}true{{ end }}
 LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
 LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
 
diff --git a/compose.ssh.yml b/compose.ssh.yml
new file mode 100644
index 0000000..40abca4
--- /dev/null
+++ b/compose.ssh.yml
@@ -0,0 +1,11 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      - GITEA_SSH_ENABLED=true
+    deploy:
+      labels:
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
+        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"
diff --git a/compose.yml b/compose.yml
index 45172c7..4d9b09e 100644
--- a/compose.yml
+++ b/compose.yml
@@ -26,7 +26,7 @@ services:
       - GITEA_ENABLE_OPENID_SIGNIN
       - GITEA_ENABLE_OPENID_SIGNUP
       - GITEA_SMTP_MAILER_ENABLED
-      - GITEA_SSH_PORT
+      - GITEA_SSH_ENABLED=false
       - GITEA_DISABLE_GRAVATAR
       - GITEA_ENABLE_FEDERATED_AVATAR
       - GITEA_REGISTER_EMAIL_CONFIRM
@@ -81,9 +81,6 @@ services:
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=3000"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
-        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_cors"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowheaders=content-type,authorization"