diff --git a/hosts/appview/services/nginx.nix b/hosts/appview/services/nginx.nix
index 44e499f..0e33c01 100644
--- a/hosts/appview/services/nginx.nix
+++ b/hosts/appview/services/nginx.nix
@@ -1,8 +1,16 @@
 {
   config,
   pkgs,
+  lib,
   ...
-}: {
+}: let
+  # Denied from the ssh stream proxy; HTTP block_scraper does not apply here.
+  sshBlocklist = [
+    "13.220.42.207"
+    "98.82.21.79"
+  ];
+  sshDenyRules = lib.concatMapStringsSep "\n        " (cidr: "deny ${cidr};") sshBlocklist;
+in {
   services.nginx = {
     enable = true;
     eventsConfig = ''
@@ -67,9 +75,7 @@
     '';
 
     streamConfig = ''
-      # Log source IPs hitting the git-over-ssh proxy. SSH is an encrypted
-      # tunnel, so we can only see connection metadata here (source IP,
-      # bytes, duration) -- not the git paths/commands inside the session.
+      # ssh is an encrypted tunnel; only connection metadata is visible here.
       log_format ssh_proxy '$remote_addr [$time_local] '
                            'proto=$protocol status=$status '
                            'sent=$bytes_sent recv=$bytes_received '
@@ -82,6 +88,10 @@
       server {
         listen 22;
         listen [::]:22;
+
+        ${sshDenyRules}
+        allow all;
+
         proxy_pass knot-sailor;
         access_log /var/log/nginx/ssh-proxy.log ssh_proxy;
       }