diff --git a/pkg/client/clientimplementation/services.go b/pkg/client/clientimplementation/services.go
index 42469fc7b..9eb26899d 100644
--- a/pkg/client/clientimplementation/services.go
+++ b/pkg/client/clientimplementation/services.go
@@ -13,13 +13,14 @@ import (
 )
 
 type StartServicesDaemonOptions struct {
-	DevPodConfig *config.Config
-	Client       client.DaemonClient
-	SSHClient    *ssh.Client
-	User         string
-	Log          log.Logger
-	ForwardPorts bool
-	ExtraPorts   []string
+	DevPodConfig     *config.Config
+	Client           client.DaemonClient
+	SSHClient        *ssh.Client
+	User             string
+	Log              log.Logger
+	ForwardPorts     bool
+	ExtraPorts       []string
+	GitSSHSigningKey string
 }
 
 type credentialConfig struct {
@@ -54,6 +55,7 @@ func StartServicesDaemon(ctx context.Context, opts StartServicesDaemonOptions) e
 			ConfigureDockerCredentials:     credConfig.docker,
 			ConfigureGitCredentials:        credConfig.git,
 			ConfigureGitSSHSignatureHelper: credConfig.gitSSHSignature,
+			GitSSHSigningKey:               opts.GitSSHSigningKey,
 			Log:                            opts.Log,
 		},
 	)
diff --git a/pkg/ide/opener/opener.go b/pkg/ide/opener/opener.go
index 72c4056b9..3eea8ba5c 100644
--- a/pkg/ide/opener/opener.go
+++ b/pkg/ide/opener/opener.go
@@ -236,13 +236,14 @@ func makeDaemonStartFunc(
 		err = clientimplementation.StartServicesDaemon(
 			ctx,
 			clientimplementation.StartServicesDaemonOptions{
-				DevPodConfig: params.DevPodConfig,
-				Client:       daemonClient,
-				SSHClient:    toolClient,
-				User:         params.User,
-				Log:          params.Log,
-				ForwardPorts: forwardPorts,
-				ExtraPorts:   extraPorts,
+				DevPodConfig:     params.DevPodConfig,
+				Client:           daemonClient,
+				SSHClient:        toolClient,
+				User:             params.User,
+				Log:              params.Log,
+				ForwardPorts:     forwardPorts,
+				ExtraPorts:       extraPorts,
+				GitSSHSigningKey: params.GitSSHSigningKey,
 			},
 		)
 		if err != nil {
diff --git a/pkg/tunnel/browser.go b/pkg/tunnel/browser.go
index 1d55bc0af..a3283811e 100644
--- a/pkg/tunnel/browser.go
+++ b/pkg/tunnel/browser.go
@@ -37,7 +37,7 @@ type BrowserTunnelParams struct {
 func StartBrowserTunnel(p BrowserTunnelParams) error {
 	if p.AuthSockID != "" {
 		go func() {
-			if err := SetupBackhaul(p.Client, p.AuthSockID, p.Logger); err != nil {
+			if err := SetupBackhaul(p.Ctx, p.Client, p.AuthSockID, p.Logger); err != nil {
 				p.Logger.Error("Failed to setup backhaul SSH connection: ", err)
 			}
 		}()
@@ -120,7 +120,12 @@ func runBrowserTunnelServices(
 }
 
 // SetupBackhaul sets up a long-running SSH connection for backhaul.
-func SetupBackhaul(client client2.BaseWorkspaceClient, authSockID string, logger log.Logger) error {
+func SetupBackhaul(
+	ctx context.Context,
+	client client2.BaseWorkspaceClient,
+	authSockID string,
+	logger log.Logger,
+) error {
 	execPath, err := os.Executable()
 	if err != nil {
 		return err
@@ -136,7 +141,7 @@ func SetupBackhaul(client client2.BaseWorkspaceClient, authSockID string, logger
 	}
 
 	//nolint:gosec // execPath is the current binary, arguments are controlled
-	backhaulCmd := exec.Command(
+	backhaulCmd := exec.CommandContext(ctx,
 		execPath,
 		"ssh",
 		"--agent-forwarding=true",
@@ -149,7 +154,7 @@ func SetupBackhaul(client client2.BaseWorkspaceClient, authSockID string, logger
 		client.Workspace(),
 		"--log-output=raw",
 		"--command",
-		"while true; do sleep 6000000; done",
+		"while true; do sleep 6000000; done", // sleep infinity is not available on all systems
 	)
 
 	if logger.GetLevel() == logrus.DebugLevel {
@@ -159,6 +164,7 @@ func SetupBackhaul(client client2.BaseWorkspaceClient, authSockID string, logger
 	logger.Info("Setting up backhaul SSH connection")
 
 	writer := logger.Writer(logrus.InfoLevel, false)
+	defer func() { _ = writer.Close() }()
 
 	backhaulCmd.Stdout = writer
 	backhaulCmd.Stderr = writer