diff --git a/deploy/install.sh b/deploy/install.sh
index 2a1d4c3..b6aa428 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -76,9 +76,13 @@ if [[ ! -x "$VENV/bin/python" ]]; then
   sudo -u "$SERVICE_USER" python -m venv "$VENV"
 fi
 sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet --upgrade pip
-# With the `search` extra: DuckDuckGo is the default web search provider and is
-# meant to work with no setup at all.
-sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]"
+# The extras a deployment gets. `search` because DuckDuckGo is the default web
+# search provider and is meant to need no setup; `ssh` because agent chats reach
+# their machine over it and a deployment without it offers the feature with an
+# install hint instead. Listed here AND in update.sh -- an extra added to only
+# one of them means existing deployments silently miss it.
+LEMBAS_EXTRAS="${LEMBAS_EXTRAS:-search,ssh}"
+sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[$LEMBAS_EXTRAS]"
 
 echo "== environment =="
 # Generated once and never regenerated: rotating LEMBAS_SECRET_KEY signs every
diff --git a/deploy/update.sh b/deploy/update.sh
index fd35400..1412697 100755
--- a/deploy/update.sh
+++ b/deploy/update.sh
@@ -37,11 +37,14 @@ else
 fi
 
 # Cheap and idempotent; catches a dependency added since the last deploy.
-# The `search` extra is included because DuckDuckGo is the default web search
-# provider and is meant to need no setup -- a deployment without it offers a
-# provider that fails on every call.
+# The extras a deployment gets. `search` because DuckDuckGo is the default web
+# search provider and is meant to need no setup; `ssh` because agent chats reach
+# their machine over it and a deployment without it offers the feature with an
+# install hint instead. Listed here AND in install.sh -- an extra added to only
+# one of them means existing deployments silently miss it.
+LEMBAS_EXTRAS="${LEMBAS_EXTRAS:-search,ssh}"
 echo "== dependencies =="
-sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]"
+sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[$LEMBAS_EXTRAS]"
 
 # The unit is NOT reinstalled automatically. An installed unit usually carries
 # host-specific lines the template cannot know about -- an ordering dependency