diff --git a/home/base/tui/ssh.nix b/home/base/tui/ssh.nix
index 3383e417..10ae885a 100644
--- a/home/base/tui/ssh.nix
+++ b/home/base/tui/ssh.nix
@@ -25,6 +25,8 @@
 
     settings = {
       "github.com" = {
+        # avoid clash fake-IP6 hang, see modules/nixos/desktop/networking/clash-verge.nix
+        AddressFamily = "inet";
         HostName = "ssh.github.com";
         Port = 443;
         User = "git";
diff --git a/modules/nixos/desktop/networking/clash-verge.nix b/modules/nixos/desktop/networking/clash-verge.nix
index e3f04180..546274f4 100644
--- a/modules/nixos/desktop/networking/clash-verge.nix
+++ b/modules/nixos/desktop/networking/clash-verge.nix
@@ -1,4 +1,17 @@
 { pkgs-master, ... }:
+# NOTE: There is a known pitfall with mihomo's fake-IP for IPv6
+# (fake-ip-range6: fdfe:dcba:9876::/64): TCP connections to IPv6 fake-IPs are
+# not proxied correctly and simply hang until connect() times out.
+# Clients without a fast IPv4 fallback stall for ~2 minutes per attempt:
+# every git remote operation (fetch/pull/push alike, they all go through ssh)
+# hangs on "Connecting to ssh.github.com [fdfe:dcba:9876::x] port 443"
+# before falling back to IPv4.
+# Browsers recover silently thanks to Happy Eyeballs (RFC 8305: when a name
+# resolves to both IPv4 and IPv6, the client tries one stack first, then races
+# the other after a ~50ms delay and keeps whichever connects first).
+# Fix: disable IPv6 in Clash Verge's DNS/TUN settings (confirmed working);
+# or work around per-client, e.g. `AddressFamily inet` in ssh_config
+# (see home/base/tui/ssh.nix).
 {
   programs.clash-verge = {
     enable = true;