diff --git a/.env.example b/.env.example
index c9d1baa..8d6f257 100644
--- a/.env.example
+++ b/.env.example
@@ -3,6 +3,7 @@ SHARED_NETWORK_NAME=web
 
 ### Public domain for Gitea (requested subdomain: git)
 GITEA_DOMAIN=git.example.com
+GITEA_SSH_PORT=2222
 
 ### Container user mapping
 GITEA_UID=1000
diff --git a/README.md b/README.md
index eb2514d..e0d4d44 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@ cp .env.example .env
 Edit `.env` and set:
 - `SHARED_NETWORK_NAME` to the same network name used by your main stack
 - `GITEA_DOMAIN` to your git subdomain (for example `git.example.com`)
+- `GITEA_SSH_PORT` to the host SSH port for Git over SSH (default in this setup: `2222`)
 - Postgres credentials for a dedicated Gitea database/user
 
 ## 2) Create Postgres DB/User (on your existing DB)
@@ -90,8 +91,36 @@ docker compose logs -f gitea
 docker compose logs -f gitea-runner
 ```
 
+## 8) Git over SSH
+
+This stack exposes Gitea SSH as `${GITEA_SSH_PORT}` on the host (default `2222`).
+
+Clone example:
+
+```bash
+git clone ssh://git@<your-gitea-domain>:2222/<owner>/<repo>.git
+```
+
+Important:
+- Include `<owner>/<repo>.git` (for example `alice/my-api.git`).
+- `git@<domain>/<repo>.git` is not valid for Gitea SSH clone URLs.
+- If you use SCP-style syntax, include the owner and rely on `~/.ssh/config` for port:
+  - `git@<your-gitea-domain>:<owner>/<repo>.git`
+
+If you want to keep using `git@<your-gitea-domain>:<owner>/<repo>.git` without specifying a port in each command, add this to your local `~/.ssh/config`:
+
+```sshconfig
+Host <your-gitea-domain>
+  HostName <your-gitea-domain>
+  User git
+  Port 2222
+  IdentitiesOnly yes
+```
+
 ## Notes
 
 - This setup uses HTTPS via Traefik labels and Let's Encrypt from your existing stack.
-- Git over SSH is not enabled in this compose because your current Traefik config only exposes `:80` and `:443`. HTTPS clone/push works directly.
+- Git over SSH is enabled by direct Docker port mapping (`${GITEA_SSH_PORT}:22`) to avoid changing your Traefik base config.
+- Port `22` on the host is often already used by the server's SSH daemon. Keep `GITEA_SSH_PORT=2222` unless you intentionally move host SSH to another port.
 - Gitea Actions is enabled (`GITEA__actions__ENABLED=true`).
+- If you ever enabled Gitea's internal SSH server before, keep `GITEA__server__START_SSH_SERVER=false` to avoid restart loops from port conflicts.
diff --git a/docker-compose.yml b/docker-compose.yml
index 4b3ace2..1e9dc00 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,8 +9,9 @@ services:
       - GITEA__server__DOMAIN=${GITEA_DOMAIN}
       - GITEA__server__ROOT_URL=https://${GITEA_DOMAIN}/
       - GITEA__server__SSH_DOMAIN=${GITEA_DOMAIN}
+      - GITEA__server__START_SSH_SERVER=false
       - GITEA__server__HTTP_PORT=3000
-      - GITEA__server__SSH_PORT=22
+      - GITEA__server__SSH_PORT=${GITEA_SSH_PORT}
       - GITEA__database__DB_TYPE=postgres
       - GITEA__database__HOST=${GITEA_DB_HOST}:${GITEA_DB_PORT}
       - GITEA__database__NAME=${GITEA_DB_NAME}
@@ -24,6 +25,8 @@ services:
       - gitea_data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "${GITEA_SSH_PORT}:22"
     labels:
       - traefik.enable=true
       - traefik.docker.network=${SHARED_NETWORK_NAME}