diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 7cc606561404..e4e1c5663fcb 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -1,5 +1,6 @@
 import logging
 import os
+import shlex
 from datetime import datetime
 from importlib.resources import files
 from pathlib import Path
@@ -17,7 +18,7 @@ from .models import (
     Profile,
     Remote,
 )
-from .process import run_wrapper
+from .process import SSH_DEFAULT_OPTS, run_wrapper
 from .utils import Args, dict_to_flags
 
 FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"]
@@ -153,12 +154,13 @@ def copy_closure(
             closure,
         ],
         extra_env={
-            # for the remote to remote case, we can't use host.opts because it
-            # includes the ControlPane opts that will not work in the remote,
-            # because the temporary directory that we created will not exist
-            "NIX_SSHOPTS": os.environ.get("NIX_SSHOPTS", "")
+            # for the remote to remote case, we can't add SSH_DEFAULT_OPTS to
+            # host.opts because it includes the ControlPane opts that will not
+            # work in the remote, because the temporary directory that we
+            # created will not exist
+            "NIX_SSHOPTS": shlex.join(host.opts)
             if from_host and to_host
-            else " ".join(host.opts)
+            else shlex.join(SSH_DEFAULT_OPTS + host.opts)
         },
         remote=from_host if to_host else None,
     )
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 54200f14d85a..a9e8d7dff295 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -38,7 +38,7 @@ class Remote:
         if not host:
             return None
 
-        opts = os.getenv("NIX_SSHOPTS", "").split()
+        opts = shlex.split(os.getenv("NIX_SSHOPTS", ""))
         if validate_opts:
             cls._validate_opts(opts, ask_sudo_password)
         sudo_password = None
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 093cba93ef36..0a98270490f9 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -8,6 +8,7 @@ import pytest
 
 import nixos_rebuild.models as m
 import nixos_rebuild.nix as n
+import nixos_rebuild.process as p
 
 from .helpers import get_qualified_name
 
@@ -108,7 +109,9 @@ def test_remote_build(mock_run: Any, monkeypatch: Any) -> None:
                     "user@host",
                     Path("/path/to/file"),
                 ],
-                extra_env={"NIX_SSHOPTS": "--ssh opts"},
+                extra_env={
+                    "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh opts"])
+                },
                 remote=None,
             ),
             call(
@@ -159,7 +162,9 @@ def test_remote_build_flake(mock_run: Any) -> None:
                     "user@host",
                     Path("/path/to/file"),
                 ],
-                extra_env={"NIX_SSHOPTS": "--ssh opts"},
+                extra_env={
+                    "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh opts"])
+                },
                 remote=None,
             ),
             call(
@@ -191,23 +196,22 @@ def test_copy_closure(mock_run: Any, monkeypatch: Any) -> None:
     n.copy_closure(closure, target_host)
     mock_run.assert_called_with(
         ["nix-copy-closure", "--to", "user@target.host", closure],
-        extra_env={"NIX_SSHOPTS": "--ssh target-opt"},
+        extra_env={"NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh target-opt"])},
         remote=None,
     )
 
     n.copy_closure(closure, None, build_host)
     mock_run.assert_called_with(
         ["nix-copy-closure", "--from", "user@build.host", closure],
-        extra_env={"NIX_SSHOPTS": "--ssh build-opt"},
+        extra_env={"NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-opt"])},
         remote=None,
     )
 
-    monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-target-opt")
     n.copy_closure(closure, target_host, build_host)
     mock_run.assert_called_with(
         ["nix-copy-closure", "--to", "user@target.host", closure],
         remote=build_host,
-        extra_env={"NIX_SSHOPTS": "--ssh build-target-opt"},
+        extra_env={"NIX_SSHOPTS": "--ssh target-opt"},
     )