diff --git a/hosts/appview/services/nginx.nix b/hosts/appview/services/nginx.nix
index 5f5b722..5231080 100644
--- a/hosts/appview/services/nginx.nix
+++ b/hosts/appview/services/nginx.nix
@@ -66,6 +66,14 @@
     '';
 
     streamConfig = ''
+      # Log source IPs hitting the git-over-ssh proxy. SSH is an encrypted
+      # tunnel, so we can only see connection metadata here (source IP,
+      # bytes, duration) -- not the git paths/commands inside the session.
+      log_format ssh_proxy '$remote_addr [$time_local] '
+                           'proto=$protocol status=$status '
+                           'sent=$bytes_sent recv=$bytes_received '
+                           'duration=$session_time upstream=$upstream_addr';
+
       upstream knot-sailor {
         server 85.9.211.103:22;
       }
@@ -74,6 +82,7 @@
         listen 22;
         listen [::]:22;
         proxy_pass knot-sailor;
+        access_log /var/log/nginx/ssh-proxy.log ssh_proxy;
       }
     '';