diff --git a/CLAUDE.md b/CLAUDE.md
index 2473e6f..7200afd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -78,7 +78,7 @@ Hard-won lessons that apply across every project:
 - **Verify scripts should be environment-resilient.** Avoid needing sudo or special access. Test from the accessible side of a connection. Use `curl --resolve` to bypass DNS/proxy layers when testing direct connectivity.
 - **Automate repeated sequences.** If you run the same 3+ commands in sequence more than once, it should become a script.
 - **Reflect after milestones.** Don't just finish — review what happened, what went wrong, what can be improved. Write it down.
-- **Pre-flight before push.** Before any `git push`: derive the SSH alias from `git remote get-url origin`, confirm that key is loaded (`ssh-add -l`). Passphrase-protected keys must be `ssh-add`ed by the user — hand off, don't retry. If a push fails: commit locally, say so explicitly, note the recovery step in CONTEXT.md. Details: `claude/source-control.md`.
+- **Pre-flight before push.** Before any `git push`: derive the SSH alias from `git remote get-url origin`, then run `ssh-add -l` and inspect the full output — keys are often pre-loaded, so always check before asking the user to load one. Use `grep -i` (case-insensitive) when scanning for the relevant key name. Only ask if the key is genuinely absent. Passphrase-protected keys must be `ssh-add`ed by the user — hand off, don't retry. If a push fails: commit locally, say so explicitly, note the recovery step in CONTEXT.md. Details: `claude/source-control.md`.
 - **Everyday shell/edit footguns.** `grep` exits 1 on no match (breaks `set -e` chains); Edit `replace_all` matches substrings — make the old string unique. Full list: `claude/scripting-conventions.md`.
 
 ## Session End
diff --git a/claude/source-control.md b/claude/source-control.md
index a1dc9b2..40ed298 100644
--- a/claude/source-control.md
+++ b/claude/source-control.md
@@ -25,10 +25,9 @@ Git remote URL format: `git@gitea.oreillyit.nz-<user>:<org>/<repo>.git`
 Before the first push of a session:
 
 1. Derive the alias: `git remote get-url origin` — the host segment is the SSH alias.
-2. Confirm the key is loaded: `ssh-add -l` — the relevant key must appear.
-3. Confirm auth: `ssh -T git@<alias>` — expect a Gitea welcome message.
-
-Claude cannot answer a passphrase prompt. If the key isn't loaded, ask the user to `ssh-add ~/.ssh/<keyfile>` before proceeding.
+2. Run `ssh-add -l` and read the **full output**. Keys are often pre-loaded — check before asking. Use `grep -i <keyname>` (case-insensitive) to find the relevant entry; a case-sensitive grep will miss keys whose comments use different capitalisation.
+3. If the key is present, proceed. Only ask the user to `ssh-add ~/.ssh/<keyfile>` if it is genuinely absent. Claude cannot answer a passphrase prompt.
+4. Confirm auth: `ssh -T git@<alias>` — expect a Gitea welcome message.
 
 In non-interactive contexts (CI, container agents, unattended loops), use `GIT_SSH_COMMAND='ssh -o BatchMode=yes' git push` so a missing credential fails fast instead of hanging on a passphrase prompt.