diff --git a/pkgs/clan-cli/clan_cli/machines/install.py b/pkgs/clan-cli/clan_cli/machines/install.py
index 22b3c301b..104ac6c1f 100644
--- a/pkgs/clan-cli/clan_cli/machines/install.py
+++ b/pkgs/clan-cli/clan_cli/machines/install.py
@@ -66,6 +66,15 @@ def install_command(args: argparse.Namespace) -> None:
             if ask != "y":
                 return None
 
+        if args.identity_file:
+            target_host = target_host.override(private_key=args.identity_file)
+
+        if password:
+            target_host = target_host.override(password=password)
+
+        if use_tor:
+            target_host = target_host.override(tor_socks=True)
+
         return run_machine_install(
             InstallOptions(
                 machine=machine,
@@ -75,9 +84,6 @@ def install_command(args: argparse.Namespace) -> None:
                 no_reboot=args.no_reboot,
                 build_on=args.build_on if args.build_on is not None else None,
                 update_hardware_config=HardwareConfig(args.update_hardware_config),
-                password=password,
-                identity_file=args.identity_file,
-                use_tor=use_tor,
             ),
             target_host=target_host,
         )
diff --git a/pkgs/clan-cli/clan_lib/machines/install.py b/pkgs/clan-cli/clan_lib/machines/install.py
index dcdecefb6..949f826ad 100644
--- a/pkgs/clan-cli/clan_lib/machines/install.py
+++ b/pkgs/clan-cli/clan_lib/machines/install.py
@@ -30,9 +30,6 @@ class InstallOptions:
     phases: str | None = None
     build_on: BuildOn | None = None
     update_hardware_config: HardwareConfig = HardwareConfig.NONE
-    password: str | None = None
-    identity_file: Path | None = None
-    use_tor: bool = False
 
 
 @API.register
@@ -72,8 +69,8 @@ def run_machine_install(opts: InstallOptions, target_host: Remote) -> None:
             machine.name, partitioning_secrets, phases=["partitioning"]
         )
 
-        if opts.password:
-            os.environ["SSHPASS"] = opts.password
+        if target_host.password:
+            os.environ["SSHPASS"] = target_host.password
 
         cmd = [
             "nixos-anywhere",
@@ -111,15 +108,15 @@ def run_machine_install(opts: InstallOptions, target_host: Remote) -> None:
                 ]
             )
 
-        if opts.password:
+        if target_host.password:
             cmd += [
                 "--env-password",
                 "--ssh-option",
                 "IdentitiesOnly=yes",
             ]
 
-        if opts.identity_file:
-            cmd += ["-i", str(opts.identity_file)]
+        if target_host.private_key:
+            cmd += ["-i", str(target_host.private_key)]
 
         if opts.build_on:
             cmd += ["--build-on", opts.build_on]
@@ -136,7 +133,7 @@ def run_machine_install(opts: InstallOptions, target_host: Remote) -> None:
         cmd.extend(opts.machine.flake.nix_options or [])
 
         cmd.append(target_host.target)
-        if opts.use_tor:
+        if target_host.tor_socks:
             # nix copy does not support tor socks proxy
             # cmd.append("--ssh-option")
             # cmd.append("ProxyCommand=nc -x 127.0.0.1:9050 -X 5 %h %p")