diff --git a/Makefile b/Makefile
index a25b90771..c7dee134c 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ endif
 
 export target_host ?= $(system)
 export target_user ?= root
+export target_port ?= 22
 export target_path ?= /var/src
 
 evaluate = \
@@ -22,7 +23,8 @@ execute = \
 # usage: make deploy system=foo [target_host=bar]
 deploy:
 	$(call execute,populate)
-	ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path)
+	ssh $(target_user)@$(target_host) -p $(target_port) \
+		nixos-rebuild switch -I $(target_path)
 
 # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
 eval eval.:;@$(call evaluate)
@@ -31,10 +33,10 @@ eval.%:;@$(call evaluate,-A $*)
 # usage: make install system=foo [target_host=bar]
 install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
 install:
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env target_path=$(target_path) \
 			sh -s prepare < krebs/4lib/infest/prepare.sh
 	target_path=/mnt$(target_path) $(call execute,populate)
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env NIXOS_CONFIG=$(target_path)/nixos-config \
 			nixos-install
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 3530fd595..1569072d1 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -51,6 +51,7 @@ let
         source = config.krebs.build.source;
         target-user = maybeEnv "target_user" "root";
         target-host = maybeEnv "target_host" config.krebs.build.host.name;
+        target-port = maybeEnv "target_port" "22";
         target-path = maybeEnv "target_path" "/var/src";
         out = ''
           #! /bin/sh
@@ -62,7 +63,8 @@ let
           }
 
           echo ${shell.escape git-script} \
-            | ssh ${shell.escape "${target-user}@${target-host}"} -T
+            | ssh -p ${shell.escape target-port} \
+                  ${shell.escape "${target-user}@${target-host}"} -T
 
           unset tmpdir
           trap '
@@ -93,6 +95,7 @@ let
                     (attrNames file-specs)} \
                   --delete \
                   -vFrlptD \
+                  -e ${shell.escape "ssh -p ${target-port}"} \
                   ${shell.escape target-path}/ \
                   ${shell.escape "${target-user}@${target-host}:${target-path}"}
         '';