diff --git a/home/default.nix b/home/default.nix
index 19dafd3..94480a6 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -115,6 +115,10 @@ in
         serverAliveInterval = 30;
         serverAliveCountMax = 10;
         compression = true;
+        controlMaster = "autoask";
+        controlPath = "~/.ssh/master-%r@%n:%p";
+        # Close socket once last connection closes
+        controlPersist = "no";
       };
     };
   };
diff --git a/home/macs.nix b/home/macs.nix
index 10f636d..7e4a1f6 100644
--- a/home/macs.nix
+++ b/home/macs.nix
@@ -19,6 +19,17 @@
     extraOptions."IdentityAgent" =
       "~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh";
   };
-  programs.zsh.sessionVariables.SSH_AUTH_SOCK = "$HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh";
+  programs.zsh.sessionVariables = {
+    SSH_AUTH_SOCK = "$HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh";
+    # Make connection muxing permission work.
+    # Openssh by default will only use SSH_ASKPASS if it sees DISPLAY/WAYLAND_DISPLAY, so we have to force it
+    SSH_ASKPASS_REQUIRE = "force";
+    # A nice applescript permission dialog
+    SSH_ASKPASS = (pkgs.fetchurl {
+      url = "https://raw.githubusercontent.com/theseal/ssh-askpass/refs/heads/master/ssh-askpass";
+      hash= "sha256-bQUuGS3Mb+i4Kt+1mDP203s2W1jlRcpl/7uXA7TUZ+o=";
+      executable = true;
+    });
+  };
   programs.zsh.initContent = "[ -e /opt/homebrew/bin/brew ] && eval $(/opt/homebrew/bin/brew shellenv)";
 }