diff --git a/.config/1Password/ssh/agent.toml b/.config/1Password/ssh/agent.toml
index 67bb24e..84f58bb 100644
--- a/.config/1Password/ssh/agent.toml
+++ b/.config/1Password/ssh/agent.toml
@@ -50,6 +50,11 @@ vault = "apwipwtqx6l4eqa27su7hlczey"
 item = "npdvnvxih5gsr3cxlonbkayoy4"
 account = "https://andreijiroh-dev.1password.com"
 
+# passwordless stuff
+[[ssh-keys]]
+item = "pntny4t3b7qdajtknrz3vgvrk4"
+account = "https://andreijiroh-dev.1password.com"
+
 # infraops
 [[ssh-keys]]
 vault = "fykuds2mmz7iletnsxkl47slbi"
@@ -60,6 +65,11 @@ account = "https://andreijiroh-dev.1password.com"
 item = "gj75ey6dr7scrckvjp33dqz3xi"
 account = "https://andreijiroh-dev.1password.com"
 
+# StudentOps stuff
+[[ssh-keys]]
+item = "ylcrbks3tkxtsgkc5gadm2dyqa"
+account = "https://andreijiroh-dev.1password.com"
+
 ## RecapTime.dev ##
 # crew.recaptime.dev
 [[ssh-keys]]
diff --git a/.gnupg/sshcontrol b/.gnupg/sshcontrol
new file mode 100644
index 0000000..cdd3707
--- /dev/null
+++ b/.gnupg/sshcontrol
@@ -0,0 +1,26 @@
+# List of allowed ssh keys.  Only keys present in this file are used
+# in the SSH protocol.  The ssh-add tool may add new entries to this
+# file to enable them; you may also add them manually.  Comment
+# lines, like this one, as well as empty lines are ignored.  Lines do
+# have a certain length limit but this is not serious limitation as
+# the format of the entries is fixed and checked by gpg-agent. A
+# non-comment line starts with optional white spaces, followed by the
+# keygrip of the key given as 40 hex digits, optionally followed by a
+# caching TTL in seconds, and another optional field for arbitrary
+# flags.   Prepend the keygrip with an '!' mark to disable it.
+
+# Ed25519 key added on: 2026-03-07 17:30:12
+# Fingerprints:  MD5:46:f9:5c:d0:e3:81:20:c4:dd:42:d3:c8:be:c8:78:61
+#                SHA256:ci+JGpHk/1StUxzbkOs1AfCGncyHvHLWwX/jPW6rRLY
+# Comment:       ajhalili2006@andreijiroh.dev (2022 SSH key)
+B5D200D72E6CA1EFD1FA389711B6EDE810F4B11A 900
+# Ed25519 key added on: 2026-03-07 17:33:18
+# Fingerprints:  MD5:72:6a:5e:67:07:80:bf:e4:c2:df:00:c0:4d:07:34:35
+#                SHA256:O2hq61uPA4jCv+gBOUCXbExRGfczSGILVqQheqih7mA
+# Comment:       @recaptimebot's SSH key
+C4C4814E3CADE7BC8F604462FF5C6825C3971CCE 900
+# Ed25519 key added on: 2026-03-07 17:35:27
+# Fingerprints:  MD5:05:39:7b:30:ed:0c:28:3c:8d:2e:9c:5d:3f:6e:21:c6
+#                SHA256:5F45aDysMyrYDCWLiIDyubAhtCXgmWzWerVMfQRjXSU
+# Comment:       passwordless auth for ~ajhalili2006
+22951B44E95ADA891584CA2E763AB03044C4D471 0
diff --git a/.ssh/configs/cf-tunnels b/.ssh/configs/cf-tunnels
new file mode 100644
index 0000000..e4ebc1f
--- /dev/null
+++ b/.ssh/configs/cf-tunnels
@@ -0,0 +1,10 @@
+Host lairland.cftunnels
+  Hostname lairland-ssh.andreijiroh.is-a.dev
+  ProxyCommand cloudflared access ssh --hostname %h
+Host stellapent-cier.cftunnels
+  Hostname stellapent-ssh.andreijiroh.is-a.dev
+  ProxyCommand cloudflared access ssh --hostname %h
+Host phorge.cftunnels
+  Hostname phorge-ssh.recaptime.dev
+  ProxyCommand cloudflared access ssh --hostname %h
+