diff --git a/examples/aws.yml b/examples/aws.yml
index 4f1d23e95..b2e57dcc2 100644
--- a/examples/aws.yml
+++ b/examples/aws.yml
@@ -18,7 +18,7 @@ services:
   - name: rngd
     image: linuxkit/rngd:v0.8
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
     binds:
      - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx
diff --git a/examples/azure.yml b/examples/azure.yml
index 838b938d7..1a9638c5c 100644
--- a/examples/azure.yml
+++ b/examples/azure.yml
@@ -15,7 +15,7 @@ services:
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.8
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/examples/gcp.yml b/examples/gcp.yml
index b27305be1..0e5dfa9e9 100644
--- a/examples/gcp.yml
+++ b/examples/gcp.yml
@@ -22,7 +22,7 @@ services:
   - name: rngd
     image: linuxkit/rngd:v0.8
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
     binds:
      - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx
diff --git a/examples/hetzner.yml b/examples/hetzner.yml
index b5d69380d..2d8b2460f 100644
--- a/examples/hetzner.yml
+++ b/examples/hetzner.yml
@@ -28,7 +28,7 @@ services:
     env:
      - INSECURE=true
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/examples/openstack.yml b/examples/openstack.yml
index 823e84b28..926cf4f72 100644
--- a/examples/openstack.yml
+++ b/examples/openstack.yml
@@ -19,7 +19,7 @@ services:
   - name: rngd
     image: linuxkit/rngd:v0.8
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
     binds:
      - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx
diff --git a/examples/packet.yml b/examples/packet.yml
index 59942bdd9..204ec8961 100644
--- a/examples/packet.yml
+++ b/examples/packet.yml
@@ -28,7 +28,7 @@ services:
     env:
      - INSECURE=true
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/examples/sshd.yml b/examples/sshd.yml
index dc55b68e4..21e340825 100644
--- a/examples/sshd.yml
+++ b/examples/sshd.yml
@@ -22,7 +22,7 @@ services:
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.8
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/examples/vpnkit-forwarder.yml b/examples/vpnkit-forwarder.yml
index a16027463..e7dff4356 100644
--- a/examples/vpnkit-forwarder.yml
+++ b/examples/vpnkit-forwarder.yml
@@ -19,7 +19,7 @@ onboot:
     command: ["sh", "-c", "mkdir /host_var/vpnkit && mount -v -t 9p -o trans=virtio,dfltuid=1001,dfltgid=50,version=9p2000 port /host_var/vpnkit"]
 services:
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
   - name: vpnkit-forwarder
     image: linuxkit/vpnkit-forwarder:v0.8
     binds:
diff --git a/examples/vultr.yml b/examples/vultr.yml
index f98156bec..ca8f80e9a 100644
--- a/examples/vultr.yml
+++ b/examples/vultr.yml
@@ -23,7 +23,7 @@ services:
   - name: rngd
     image: linuxkit/rngd:v0.8
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
     binds:
      - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx
diff --git a/pkg/sshd/Dockerfile b/pkg/sshd/Dockerfile
index 07dc25878..b0a829dcb 100644
--- a/pkg/sshd/Dockerfile
+++ b/pkg/sshd/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:e2391e0b164c57db9f6c4ae110ee84f766edc430 AS mirror
+FROM linuxkit/alpine:a3d78322152a8b341bdaecfe182a2689fdbdee53 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
@@ -7,6 +7,7 @@ RUN apk add --no-cache --initdb -p /out \
     busybox \
     ca-certificates \
     musl \
+    openssh-client \
     openssh-server \
     tini \
     util-linux \
diff --git a/projects/miragesdk/examples/mirage-dhcp.yml b/projects/miragesdk/examples/mirage-dhcp.yml
index c460dbf68..bce8380a4 100644
--- a/projects/miragesdk/examples/mirage-dhcp.yml
+++ b/projects/miragesdk/examples/mirage-dhcp.yml
@@ -28,7 +28,7 @@ onboot:
      - /lib:/lib     # for ifconfig
 services:
   - name: sshd
-    image: linuxkit/sshd:v0.8
+    image: linuxkit/sshd:666b4a1a323140aa1f332826164afba506abf597
   - name: getty
     image: linuxkit/getty:v0.8
     env: