diff --git a/scripts/ssh/ssh-exec.php b/scripts/ssh/ssh-exec.php
index 39bed2a701..93b808be92 100755
--- a/scripts/ssh/ssh-exec.php
+++ b/scripts/ssh/ssh-exec.php
@@ -19,6 +19,7 @@ $args->setSynopsis(<<<EOSYNOPSIS
 EOSYNOPSIS
 );
 
+$args->parseStandardArguments();
 $args->parse(
   array(
     array(
diff --git a/src/applications/diffusion/config/PhabricatorDiffusionConfigOptions.php b/src/applications/diffusion/config/PhabricatorDiffusionConfigOptions.php
index 889de07cc0..8bf13db16e 100644
--- a/src/applications/diffusion/config/PhabricatorDiffusionConfigOptions.php
+++ b/src/applications/diffusion/config/PhabricatorDiffusionConfigOptions.php
@@ -113,6 +113,7 @@ final class PhabricatorDiffusionConfigOptions
             "Consider using SSH for authenticated access to repositories ".
             "instead of HTTP.")),
       $this->newOption('diffusion.ssh-user', 'string', null)
+        ->setLocked(true)
         ->setSummary(pht('Login username for SSH connections to repositories.'))
         ->setDescription(
           pht(
@@ -120,12 +121,22 @@ final class PhabricatorDiffusionConfigOptions
             'fill in this login username. If you have configured a VCS user '.
             'like `git`, you should provide it here.')),
       $this->newOption('diffusion.ssh-port', 'int', null)
+        ->setLocked(true)
         ->setSummary(pht('Port for SSH connections to repositories.'))
         ->setDescription(
           pht(
             'When constructing clone URIs to show to users, Diffusion by '.
             'default will not display a port assuming the default for your '.
             'VCS. Explicitly declare when running on a non-standard port.')),
+      $this->newOption('diffusion.ssh-host', 'string', null)
+        ->setLocked(true)
+        ->setSummary(pht('Host for SSH connections to repositories.'))
+        ->setDescription(
+          pht(
+            'If you accept Phabricator SSH traffic on a different host '.
+            'from web traffic (for example, if you use different SSH and '.
+            'web load balancers), you can set the SSH hostname here. This '.
+            'is an advanced option.')),
     );
   }
 
diff --git a/src/applications/repository/storage/PhabricatorRepository.php b/src/applications/repository/storage/PhabricatorRepository.php
index 8181814959..170914171d 100644
--- a/src/applications/repository/storage/PhabricatorRepository.php
+++ b/src/applications/repository/storage/PhabricatorRepository.php
@@ -1006,6 +1006,11 @@ final class PhabricatorRepository extends PhabricatorRepositoryDAO
       $uri->setUser($ssh_user);
     }
 
+    $ssh_host = PhabricatorEnv::getEnvConfig('diffusion.ssh-host');
+    if (strlen($ssh_host)) {
+      $uri->setDomain($ssh_host);
+    }
+
     $uri->setPort(PhabricatorEnv::getEnvConfig('diffusion.ssh-port'));
 
     return $uri;