diff --git a/ssh/config b/ssh/config
index 71126a4..f386da7 100644
--- a/ssh/config
+++ b/ssh/config
@@ -13,6 +13,6 @@ Host *
   ForwardAgent no
   StrictHostKeyChecking=accept-new
 
-# 1Password agent - only when no agent is already available (e.g., from forwarding)
-Match host * exec "test -z \"$SSH_AUTH_SOCK\""
+# 1Password agent - use unless in SSH session (forwarded agent)
+Match host * exec "sh -c 'test -z \"$SSH_CONNECTION\"'"
   IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"