diff --git a/config/forgejo/ssh/keys.py b/config/forgejo/ssh/keys.py
index 1844619485964bf7db80b5362c51f7288c8ef11d..c8539682e3e70fad951a83376e41e77f7f5c80d4 100755
--- a/config/forgejo/ssh/keys.py
+++ b/config/forgejo/ssh/keys.py
@@ -2,6 +2,7 @@
 import sys
 import subprocess
 import re
+import json
 
 user, key_type, key = sys.argv[1:4]
 
@@ -41,8 +42,38 @@ def get_key_id(container: str):
 
 clover_id = get_key_id("forgejo")
 evil_id = get_key_id("evil-forgejo")
+knot_did = None
 
-if not clover_id and not evil_id:
+try:
+    result = subprocess.run(
+        [
+            "sudo",
+            "/usr/bin/docker",
+            "exec",
+            "knot",
+            "/usr/bin/knot",
+            "keys",
+            "-output",
+            "json",
+            "-internal-api",
+            "http://localhost:5444",
+            "-git-dir",
+            "/home/git/repositories",
+            "-log-path",
+            "/tmp/knotguard.log",
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    for entry in json.loads(result.stdout):
+        if entry.get("key") == f"{key_type} {key}":
+            knot_did = entry.get("did")
+            break
+except:
+    pass
+
+if not clover_id and not evil_id and not knot_did:
     sys.exit(0)
 
 args: list[str] = []
@@ -50,6 +81,8 @@ if clover_id:
     args.extend(["--clover", clover_id])
 if evil_id:
     args.extend(["--evil", evil_id])
+if knot_did:
+    args.extend(["--knot", knot_did])
 
 cmd = "/mnt/storage1/apps/home-infra/config/forgejo/ssh/route.sh " + " ".join(args)
 print(
diff --git a/config/forgejo/ssh/route.sh b/config/forgejo/ssh/route.sh
index 84cc31cea19cff4263c0412769049e7314ee1d4b..4549f09d0fef3bb953a513aeff7e9b773e368555 100755
--- a/config/forgejo/ssh/route.sh
+++ b/config/forgejo/ssh/route.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 clover_id=""
 evil_id=""
+knot_did=""
 
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -12,6 +13,10 @@ while [ $# -gt 0 ]; do
     evil_id="$2"
     shift 2
     ;;
+  --knot)
+    knot_did="$2"
+    shift 2
+    ;;
   *) shift ;;
   esac
 done
@@ -20,29 +25,69 @@ repo="${SSH_ORIGINAL_COMMAND#* }"
 repo="${repo%\'*}"
 repo="${repo#\'}"
 repo="${repo#/}"
-
-case "$repo" in
-*[!a-zA-Z0-9/_.-]*)
-  echo "invalid repo name: $repo" >&2
-  exit 1
-  ;;
-*..*)
-  echo "invalid repo name: $repo" >&2
-  exit 1
-  ;;
-/*)
-  echo "invalid repo name: $repo" >&2
-  exit 1
-  ;;
-esac
+repo="${repo%.git}"
 
 if [ -z "$repo" ]; then
   echo "your git ssh key works :3" >&2
   exit 1
 fi
-if [[ "$repo" != *".git" ]]; then
-  repo="$repo.git"
-fi
+
+git_command="${SSH_ORIGINAL_COMMAND%% *}"
+
+case "$git_command" in
+git-receive-pack | git-upload-pack | git-upload-archive) ;;
+*)
+  echo "invalid git command" >&2
+  exit 1
+  ;;
+esac
+
+case "$repo" in
+did:plc:*)
+  case "${repo#did:plc:}" in
+  *[!a-zA-Z0-9]* | "")
+    echo "invalid repo name: $repo" >&2
+    exit 1
+    ;;
+  esac
+  ;;
+*[!a-zA-Z0-9/_.-]*)
+  echo "invalid repo name: $repo" >&2
+  exit 1
+  ;;
+esac
+
+case "$repo" in
+*..* | /*)
+  echo "invalid repo name: $repo" >&2
+  exit 1
+  ;;
+esac
+
+route_knot() {
+  [ -z "$knot_did" ] && echo "ssh key is not configured for repository on knot.paperclover.net" >&2 && exit 1
+  exec sudo docker exec -i -u git knot /usr/bin/env \
+    SSH_ORIGINAL_COMMAND="$git_command '$repo'" \
+    SSH_CONNECTION="$SSH_CONNECTION" \
+    /usr/bin/knot guard \
+    -git-dir /home/git/repositories \
+    -user "$knot_did" \
+    -log-path /tmp/knotguard.log \
+    -internal-api http://localhost:5444
+}
+
+case "$repo" in
+did:plc:*)
+  route_knot
+  ;;
+*/*)
+  if [ ! -d "/mnt/storage1/apps/forgejo/git/repositories/${repo}.git" ] && [ ! -d "/mnt/storage1/apps/evil-infra/forgejo/git/repositories/${repo}.git" ]; then
+    route_knot
+  fi
+  ;;
+esac
+
+repo="$repo.git"
 
 if [ -d "/mnt/storage1/apps/forgejo/git/repositories/${repo}" ]; then
   [ -z "$clover_id" ] && echo "ssh key is not configured for repository on git.paperclover.net" >&2 && exit 1