diff --git a/src/client.rs b/src/client.rs
index 552aed1..7837bd1 100644
--- a/src/client.rs
+++ b/src/client.rs
@@ -201,7 +201,6 @@ impl DoshClientBuilder {
             match connect_sdk_peer(
                 peer_addr,
                 &self.client.config,
-                &host_config,
                 &self.host,
                 &raw_server,
                 ssh_port,
@@ -244,7 +243,6 @@ impl ConnectedDoshClient {
 async fn connect_sdk_peer(
     peer_addr: SocketAddr,
     config: &ClientConfig,
-    host_config: &HostConfig,
     host: &str,
     server: &str,
     ssh_port: Option<u16>,
@@ -311,18 +309,17 @@ async fn connect_sdk_peer(
         &hello,
         &server_hello.hello,
     )?;
-    let auth = sign_auth(
+    let auth = sign_auth(NativeAuthSignRequest {
         config,
-        host_config,
-        &hello,
-        &server_hello.hello,
-        requested_forwardings.to_vec(),
-        identity_files.to_vec(),
+        hello: &hello,
+        server_hello: &server_hello.hello,
+        requested_forwardings: requested_forwardings.to_vec(),
+        explicit_identity_files: identity_files.to_vec(),
         use_ssh_agent,
         server,
         ssh_port,
         ssh_config,
-    )?;
+    })?;
     let mut pending_id = [0u8; 16];
     pending_id.copy_from_slice(&server_hello.hello.auth_challenge[..16]);
     let auth_packet = protocol::encode_encrypted(
@@ -387,18 +384,30 @@ fn verify_or_trust_host(
     }
 }
 
-fn sign_auth(
-    config: &ClientConfig,
-    _host_config: &HostConfig,
-    hello: &NativeClientHello,
-    server_hello: &native::NativeServerHello,
+struct NativeAuthSignRequest<'a> {
+    config: &'a ClientConfig,
+    hello: &'a NativeClientHello,
+    server_hello: &'a native::NativeServerHello,
     requested_forwardings: Vec<ForwardingRequest>,
     explicit_identity_files: Vec<PathBuf>,
     use_ssh_agent: Option<bool>,
-    server: &str,
+    server: &'a str,
     ssh_port: Option<u16>,
-    ssh_config: &SdkSshConfig,
-) -> Result<native::NativeUserAuth> {
+    ssh_config: &'a SdkSshConfig,
+}
+
+fn sign_auth(request: NativeAuthSignRequest<'_>) -> Result<native::NativeUserAuth> {
+    let NativeAuthSignRequest {
+        config,
+        hello,
+        server_hello,
+        requested_forwardings,
+        explicit_identity_files,
+        use_ssh_agent,
+        server,
+        ssh_port,
+        ssh_config,
+    } = request;
     let use_agent = use_ssh_agent.unwrap_or(config.use_ssh_agent);
     let mut errors = Vec::new();
     if use_agent && !ssh_config.identities_only {
@@ -448,12 +457,6 @@ fn sdk_identity_paths(
     for path in explicit_identity_files {
         push_identity_path(&mut paths, path);
     }
-    for path in &ssh_config.identity_files {
-        push_identity_path(
-            &mut paths,
-            expand_tilde(&expand_ssh_path_tokens(path, token_context)),
-        );
-    }
     if !ssh_config.identities_only {
         for path in &config.identity_files {
             push_identity_path(
@@ -462,6 +465,12 @@ fn sdk_identity_paths(
             );
         }
     }
+    for path in &ssh_config.identity_files {
+        push_identity_path(
+            &mut paths,
+            expand_tilde(&expand_ssh_path_tokens(path, token_context)),
+        );
+    }
     paths
 }
 
@@ -818,10 +827,10 @@ fn local_username() -> Option<String> {
     local_username_from_env(|name| std::env::var(name).ok())
 }
 
-fn local_username_from_env(mut get: impl FnMut(&str) -> Option<String>) -> Option<String> {
+fn local_username_from_env(get: impl FnMut(&str) -> Option<String>) -> Option<String> {
     ["USER", "USERNAME"]
         .into_iter()
-        .filter_map(|name| get(name))
+        .filter_map(get)
         .find(|value| !value.is_empty())
 }
 
@@ -1092,7 +1101,7 @@ mod tests {
 
         let paths = sdk_identity_paths(&config, Vec::new(), &ssh_config, &token_context);
 
-        assert_eq!(paths, vec![dir.path().join("ssh"), config_identity]);
+        assert_eq!(paths, vec![config_identity, dir.path().join("ssh")]);
     }
 
     #[test]