diff --git a/hosts/pinwheel/modules/ssh/default.nix b/hosts/pinwheel/modules/ssh/default.nix
index fb8cf03..e0c12bf 100644
--- a/hosts/pinwheel/modules/ssh/default.nix
+++ b/hosts/pinwheel/modules/ssh/default.nix
@@ -7,6 +7,11 @@
   services.gnome.gcr-ssh-agent.enable = false;
   programs.ssh.startAgent = true;
 
+  # Create the setuid `fusermount3` wrapper that `sshfs` execs to mount. The
+  # `programs.fuse` module used to install this unconditionally; newer nixpkgs
+  # gates it behind this option (default off), so opt in explicitly.
+  programs.fuse.enable = true;
+
   home-manager.users.alex = {
     services.gnome-keyring = {
       enable = true;