{
  programs.ssh = {
    ciphers = [
      "chacha20-poly1305@openssh.com"
      "aes256-gcm@openssh.com"
      "aes128-gcm@openssh.com"
      "aes256-ctr"
      "aes192-ctr"
      "aes128-ctr"
    ];
    macs = [
      "umac-128-etm@openssh.com"
      "hmac-sha2-256-etm@openssh.com"
      "hmac-sha2-512-etm@openssh.com"
    ];
    kexAlgorithms = [
      # Experimental, disabled for now.
      # "sntrup761x25519-sha512@openssh.com"
      "curve25519-sha256"
      "curve25519-sha256@libssh.org"
      # Disabled for being 2048-bit
      # "diffie-hellman-group-exchange-sha256"
    ];
    hostKeyAlgorithms = [
      "ssh-ed25519-cert-v01@openssh.com"
      "sk-ssh-ed25519-cert-v01@openssh.com"
      "rsa-sha2-512-cert-v01@openssh.com"
      "rsa-sha2-256-cert-v01@openssh.com"
      "ssh-ed25519"
      "sk-ssh-ed25519@openssh.com"
      "rsa-sha2-512"
      "rsa-sha2-256"
    ];
  };
}