diff --git a/README.md b/README.md
index 67e7c06..0d49d93 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ The client always tries the cheapest valid path first:
 2. **UDP attach ticket:** cached server-issued attach ticket for the same
    host/user/session/mode. No SSH. One encrypted UDP request, one encrypted UDP
    reply.
-3. **SSH bootstrap:** `ssh -T user@host dosh-auth ...`, then one encrypted UDP
+3. **SSH bootstrap:** `ssh -T user@host ~/.local/bin/dosh-auth ...`, then one encrypted UDP
    attach.
 4. **New session:** same as attach, but the server must create the PTY/shell unless
    the session was prewarmed.
diff --git a/SPEC.md b/SPEC.md
index c3a66a7..2afd1d2 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -3,7 +3,7 @@
 **Status:** Implemented Rust build with local and Docker SSH verification  
 **Default language:** Rust, unless benchmarks prove the stack is the bottleneck  
 **Binaries:** `dosh-server`, `dosh-client`, `dosh-auth`, `dosh-bench`  
-**Helper mode:** `dosh-server auth` or `dosh-auth`, invoked by SSH with `-T`
+**Helper mode:** `dosh-server auth` or `~/.local/bin/dosh-auth`, invoked by SSH with `-T`
 
 ---
 
@@ -96,7 +96,7 @@ host/user/session/mode:
    - Receives `AttachOk` with session key, `ClientId`, and snapshot.
 
 3. **SSH bootstrap**
-   - Runs `ssh -T user@host dosh-auth ...`.
+   - Runs `ssh -T user@host ~/.local/bin/dosh-auth ...`.
    - Receives attach token, attach ticket, session key material, and server metadata.
    - Sends `BootstrapAttachRequest`.
    - Receives `AttachOk` with `ClientId` and snapshot.
@@ -185,7 +185,7 @@ No terminal bytes are sent outside AEAD after the attach handshake begins.
 Client command:
 
 ```bash
-ssh -T user@host dosh-auth \
+ssh -T user@host ~/.local/bin/dosh-auth \
   --protocol 1 \
   --nonce <client_nonce> \
   --session <name> \
@@ -454,6 +454,7 @@ Client config: `~/.config/dosh/client.toml`
 
 ```toml
 server = "user@example.com"
+ssh_auth_command = "~/.local/bin/dosh-auth"
 # ssh_port = 22
 dosh_port = 50000
 default_session = "default"
diff --git a/install.ps1 b/install.ps1
index 75db057..34a3bc6 100644
--- a/install.ps1
+++ b/install.ps1
@@ -51,6 +51,7 @@ try {
         @"
 server = "$defaultServer"
 $doshHostLine
+ssh_auth_command = "~/.local/bin/dosh-auth"
 # ssh_port = 22
 dosh_port = $Port
 default_session = "default"
diff --git a/install.sh b/install.sh
index d6548fd..355d21f 100755
--- a/install.sh
+++ b/install.sh
@@ -209,6 +209,7 @@ if [ "$role" = "client" ] || [ "$role" = "both" ]; then
     cat >"$client_config" <<EOF
 server = "$default_server"
 $dosh_host_line
+ssh_auth_command = "~/.local/bin/dosh-auth"
 # ssh_port = 22
 dosh_port = $port
 default_session = "default"
diff --git a/src/bin/dosh-bench.rs b/src/bin/dosh-bench.rs
index 16eaf7a..968a29b 100644
--- a/src/bin/dosh-bench.rs
+++ b/src/bin/dosh-bench.rs
@@ -23,7 +23,7 @@ struct Args {
     local_auth: bool,
     #[arg(long)]
     client: Option<PathBuf>,
-    #[arg(long, default_value = "dosh-auth")]
+    #[arg(long, default_value = "~/.local/bin/dosh-auth")]
     ssh_auth_command: String,
     #[arg(long)]
     ssh_key: Option<PathBuf>,
diff --git a/src/bin/dosh-client.rs b/src/bin/dosh-client.rs
index b259dd9..8b63e75 100644
--- a/src/bin/dosh-client.rs
+++ b/src/bin/dosh-client.rs
@@ -39,8 +39,8 @@ struct Args {
     attach_only: bool,
     #[arg(long)]
     ssh_port: Option<u16>,
-    #[arg(long, default_value = "dosh-auth")]
-    ssh_auth_command: String,
+    #[arg(long)]
+    ssh_auth_command: Option<String>,
     #[arg(long)]
     ssh_key: Option<std::path::PathBuf>,
     #[arg(long)]
@@ -81,6 +81,11 @@ async fn main() -> Result<()> {
     }
     .to_string();
     let ssh_port = args.ssh_port.or(config.ssh_port);
+    let ssh_auth_command = args
+        .ssh_auth_command
+        .clone()
+        .or_else(|| config.ssh_auth_command.clone())
+        .unwrap_or_else(|| "~/.local/bin/dosh-auth".to_string());
     let dosh_port = args.dosh_port.unwrap_or(config.dosh_port);
     let cache_path = cache_path(&config.credential_cache, &server, &session, &mode);
     let (cols, rows) = size().unwrap_or((80, 24));
@@ -164,7 +169,7 @@ async fn main() -> Result<()> {
         let mut bootstrap = ssh_bootstrap(
             &server,
             ssh_port,
-            &args.ssh_auth_command,
+            &ssh_auth_command,
             args.ssh_key.as_deref(),
             args.ssh_known_hosts.as_deref(),
             args.ssh_control_path.as_deref(),
diff --git a/src/config.rs b/src/config.rs
index 30aec34..02acd9c 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -46,6 +46,7 @@ impl Default for ServerConfig {
 pub struct ClientConfig {
     pub server: String,
     pub dosh_host: Option<String>,
+    pub ssh_auth_command: Option<String>,
     pub ssh_port: Option<u16>,
     pub dosh_port: u16,
     pub default_session: String,
@@ -60,6 +61,7 @@ impl Default for ClientConfig {
         Self {
             server: "user@example.com".to_string(),
             dosh_host: None,
+            ssh_auth_command: Some("~/.local/bin/dosh-auth".to_string()),
             ssh_port: None,
             dosh_port: 50000,
             default_session: "default".to_string(),