diff --git a/src/shared/ssh-config-alias.test.ts b/src/shared/ssh-config-alias.test.ts
index 1e154b38bdb..ecd942978b6 100644
--- a/src/shared/ssh-config-alias.test.ts
+++ b/src/shared/ssh-config-alias.test.ts
@@ -45,8 +45,17 @@ describe('sshEndpointIdentity', () => {
     expect(sshEndpointIdentity({ port: 22, username: 'me' })).toBe('')
   })
 
-  it('ignores a non-finite port rather than keying on NaN', () => {
-    expect(sshEndpointIdentity({ host: 'box', port: Number.NaN, username: 'me' })).toBe(
+  it.each([Number.NaN, 0, -1, 1.5, 65_536])(
+    'normalizes invalid port %s to the SSH default',
+    (port) => {
+      expect(sshEndpointIdentity({ host: 'box', port, username: 'me' })).toBe(
+        sshEndpointIdentity({ host: 'box', port: 22, username: 'me' })
+      )
+    }
+  )
+
+  it.each([1, 65_535])('keeps valid boundary port %s', (port) => {
+    expect(sshEndpointIdentity({ host: 'box', port, username: 'me' })).not.toBe(
       sshEndpointIdentity({ host: 'box', port: 22, username: 'me' })
     )
   })
diff --git a/src/shared/ssh-config-alias.ts b/src/shared/ssh-config-alias.ts
index b5800c08cab..594a5d82226 100644
--- a/src/shared/ssh-config-alias.ts
+++ b/src/shared/ssh-config-alias.ts
@@ -18,6 +18,12 @@ export function sshEndpointIdentity(target: {
   if (!host) {
     return ''
   }
-  const port = typeof target.port === 'number' && Number.isFinite(target.port) ? target.port : 22
+  const port =
+    typeof target.port === 'number' &&
+    Number.isInteger(target.port) &&
+    target.port >= 1 &&
+    target.port <= 65_535
+      ? target.port
+      : 22
   return `${host}\u0000${port}\u0000${target.username?.trim().toLowerCase() ?? ''}`
 }