diff --git a/CHANGELOG.md b/CHANGELOG.md
index 65e094dae..fb7a5f896 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -83,6 +83,7 @@
 - Commands/Tools: disable /restart and gateway restart tool by default (enable with commands.restart=true).
 - Gateway/CLI: add `clawdbot gateway discover` (Bonjour scan on `local.` + `clawdbot.internal.`) with `--timeout` and `--json`. — thanks @steipete
 - Gateway/CLI: make `clawdbot gateway status` human-readable by default, add `--json`, and probe localhost + configured remote (warn on multiple gateways). — thanks @steipete
+- Gateway/CLI: support remote loopback gateways via SSH tunnel in `clawdbot gateway status` (`--ssh` / `--ssh-auto`). — thanks @steipete
 - CLI: add global `--no-color` (and respect `NO_COLOR=1`) to disable ANSI output. — thanks @steipete
 - CLI: centralize lobster palette + apply it to onboarding/config prompts. — thanks @steipete
 - Gateway/CLI: add `clawdbot gateway --dev/--reset` to auto-create a dev config/workspace with a robot identity (no BOOTSTRAP.md). — thanks @steipete
diff --git a/src/config/schema.ts b/src/config/schema.ts
index 34906f28a..a299c47e3 100644
--- a/src/config/schema.ts
+++ b/src/config/schema.ts
@@ -81,6 +81,8 @@ const GROUP_ORDER: Record<string, number> = {
 
 const FIELD_LABELS: Record<string, string> = {
   "gateway.remote.url": "Remote Gateway URL",
+  "gateway.remote.sshTarget": "Remote Gateway SSH Target",
+  "gateway.remote.sshIdentity": "Remote Gateway SSH Identity",
   "gateway.remote.token": "Remote Gateway Token",
   "gateway.remote.password": "Remote Gateway Password",
   "gateway.auth.token": "Gateway Token",
@@ -134,6 +136,10 @@ const FIELD_LABELS: Record<string, string> = {
 
 const FIELD_HELP: Record<string, string> = {
   "gateway.remote.url": "Remote Gateway WebSocket URL (ws:// or wss://).",
+  "gateway.remote.sshTarget":
+    "Remote gateway over SSH (tunnels the gateway port to localhost). Format: user@host or user@host:port.",
+  "gateway.remote.sshIdentity":
+    "Optional SSH identity file path (passed to ssh -i).",
   "gateway.auth.token":
     "Required for multi-machine access or non-loopback binds.",
   "gateway.auth.password": "Required for Tailscale funnel.",
@@ -208,6 +214,7 @@ const FIELD_HELP: Record<string, string> = {
 
 const FIELD_PLACEHOLDERS: Record<string, string> = {
   "gateway.remote.url": "ws://host:18789",
+  "gateway.remote.sshTarget": "user@host",
   "gateway.controlUi.basePath": "/clawdbot",
 };
 
diff --git a/src/config/zod-schema.ts b/src/config/zod-schema.ts
index 083d53a11..462a54cda 100644
--- a/src/config/zod-schema.ts
+++ b/src/config/zod-schema.ts
@@ -1283,6 +1283,8 @@ export const ClawdbotSchema = z.object({
       remote: z
         .object({
           url: z.string().optional(),
+          sshTarget: z.string().optional(),
+          sshIdentity: z.string().optional(),
           token: z.string().optional(),
           password: z.string().optional(),
         })