diff --git a/pkgs/clan-cli/clan_cli/ssh.py b/pkgs/clan-cli/clan_cli/ssh.py
index b07c4d093..0eac6810b 100644
--- a/pkgs/clan-cli/clan_cli/ssh.py
+++ b/pkgs/clan-cli/clan_cli/ssh.py
@@ -3,6 +3,8 @@ import json
 import subprocess
 from typing import Optional
 
+from .nix import nix_shell
+
 
 def ssh(
     host: str,
@@ -10,15 +12,10 @@ def ssh(
     password: Optional[str] = None,
     ssh_args: list[str] = [],
 ) -> None:
-    nix_shell_args = []
+    packages = ["tor", "openssh"]
     password_args = []
     if password:
-        nix_shell_args = [
-            "nix",
-            "shell",
-            "nixpkgs#sshpass",
-            "-c",
-        ]
+        packages.append("sshpass")
         password_args = [
             "sshpass",
             "-p",
@@ -32,23 +29,22 @@ def ssh(
         "StrictHostKeyChecking=no",
         f"{user}@{host}",
     ]
-    cmd = nix_shell_args + ["torify"] + password_args + _ssh_args
+    cmd = nix_shell(packages, ["torify"] + password_args + _ssh_args)
     subprocess.run(cmd)
 
 
 def qrcode_scan(pictureFile: str) -> str:
     return (
         subprocess.run(
-            [
-                "nix",
-                "shell",
-                "nixpkgs#zbar",
-                "-c",
-                "zbarimg",
-                "--quiet",
-                "--raw",
-                pictureFile,
-            ],
+            nix_shell(
+                ["zbar"],
+                [
+                    "zbarimg",
+                    "--quiet",
+                    "--raw",
+                    pictureFile,
+                ],
+            ),
             stdout=subprocess.PIPE,
             check=True,
         )
diff --git a/pkgs/clan-cli/tests/test_clan_ssh.py b/pkgs/clan-cli/tests/test_clan_ssh.py
index 77dcc4e91..de42ca119 100644
--- a/pkgs/clan-cli/tests/test_clan_ssh.py
+++ b/pkgs/clan-cli/tests/test_clan_ssh.py
@@ -1,5 +1,7 @@
+import os
 import sys
-from typing import Union
+from contextlib import contextmanager
+from typing import Iterator, Union
 
 import pytest
 import pytest_subprocess.fake_process
@@ -18,45 +20,72 @@ def test_no_args(
     assert captured.err.startswith("usage:")
 
 
+@contextmanager
+def mock_env(**environ: str) -> Iterator[None]:
+    original_environ = dict(os.environ)
+    os.environ.update(environ)
+    try:
+        yield
+    finally:
+        os.environ.clear()
+        os.environ.update(original_environ)
+
+
 # using fp fixture from pytest-subprocess
 def test_ssh_no_pass(fp: pytest_subprocess.fake_process.FakeProcess) -> None:
-    host = "somehost"
-    user = "user"
-    cmd: list[Union[str, utils.Any]] = [
-        "torify",
-        "ssh",
-        "-o",
-        "UserKnownHostsFile=/dev/null",
-        "-o",
-        "StrictHostKeyChecking=no",
-        f"{user}@{host}",
-        fp.any(),
-    ]
-    fp.register(cmd)
-    clan_cli.ssh.ssh(
-        host=host,
-        user=user,
-    )
-    assert fp.call_count(cmd) == 1
+    with mock_env(CLAN_NIXPKGS="/mocked-nixpkgs"):
+        host = "somehost"
+        user = "user"
+        cmd: list[Union[str, utils.Any]] = [
+            "nix",
+            "shell",
+            "-f",
+            "/mocked-nixpkgs",
+            "tor",
+            "openssh",
+            "-c",
+            "torify",
+            "ssh",
+            "-o",
+            "UserKnownHostsFile=/dev/null",
+            "-o",
+            "StrictHostKeyChecking=no",
+            f"{user}@{host}",
+            fp.any(),
+        ]
+        fp.register(cmd)
+        clan_cli.ssh.ssh(
+            host=host,
+            user=user,
+        )
+        assert fp.call_count(cmd) == 1
 
 
 def test_ssh_with_pass(fp: pytest_subprocess.fake_process.FakeProcess) -> None:
-    host = "somehost"
-    user = "user"
-    cmd: list[Union[str, utils.Any]] = [
-        "nix",
-        "shell",
-        "nixpkgs#sshpass",
-        "-c",
-        fp.any(),
-    ]
-    fp.register(cmd)
-    clan_cli.ssh.ssh(
-        host=host,
-        user=user,
-        password="XXX",
-    )
-    assert fp.call_count(cmd) == 1
+    with mock_env(CLAN_NIXPKGS="/mocked-nixpkgs"):
+        host = "somehost"
+        user = "user"
+        cmd: list[Union[str, utils.Any]] = [
+            "nix",
+            "shell",
+            "-f",
+            "/mocked-nixpkgs",
+            "tor",
+            "openssh",
+            "sshpass",
+            "-c",
+            "torify",
+            "sshpass",
+            "-p",
+            fp.any(),
+        ]
+        fp.register(cmd)
+        clan_cli.ssh.ssh(
+            host=host,
+            user=user,
+            password="XXX",
+        )
+        assert fp.call_count(cmd) == 1
 
 
 def test_qrcode_scan(fp: pytest_subprocess.fake_process.FakeProcess) -> None: