diff --git a/src/ui/app.rs b/src/ui/app.rs
index 25ac9d5b..1f9db169 100644
--- a/src/ui/app.rs
+++ b/src/ui/app.rs
@@ -6474,9 +6474,6 @@ impl Render for Tty7App {
             )
             .child(body)
             .when_some(self.pane_landing(window, cx), |this, el| this.child(el))
-            .when_some(self.render_ssh_prompt_overlay(window, cx), |this, el| {
-                this.child(el)
-            })
             .when_some(ssh_status, |this, el| this.child(el))
             .when_some(self.render_remote_workspace_strip(cx), |this, el| {
                 this.child(el)
@@ -6914,6 +6911,13 @@ impl Render for Tty7App {
                 .when_some(self.render_worktree_prompt_overlay(cx), |this, el| {
                     this.child(el)
                 })
+                // Same reason, and the ssh prompt has more claim to it than any
+                // of them: nothing in the window can proceed until the password
+                // is answered, so the scrim has to cover the whole window and
+                // not stop at the terminal area.
+                .when_some(self.render_ssh_prompt_overlay(window, cx), |this, el| {
+                    this.child(el)
+                })
                 .children(self.render_switcher(window, cx))
                 .when_some(self.palette.clone(), |this, palette| this.child(palette))
                 .children(gpui_component::Root::render_notification_layer(window, cx));
@@ -7288,10 +7292,14 @@ pub(crate) fn new_terminal(
         owner,
         font_size,
     };
+    // The same leak the reconnect banner had: this name is read out as
+    // "Connecting to {machine}…" and "Could not reach {machine}", and a
+    // `Profile` target spells itself as its config UUID (#485). The pane's own
+    // notifications already resolve it through the live config.
     let machine = spawn
         .workspace
         .as_ref()
-        .map(|w| w.target.to_string())
+        .map(|w| crate::ui::remote_connect::target_label(cx, &w.target))
         .unwrap_or_else(|| t(L10nKey::AppLocalServerName).to_string());
     let pending = cx.new(|cx| crate::ui::pending_pane::PendingPane::new(machine, spawn, cx));
     cx.subscribe_in(
diff --git a/src/ui/remote_workspace.rs b/src/ui/remote_workspace.rs
index 798f741f..8490202b 100644
--- a/src/ui/remote_workspace.rs
+++ b/src/ui/remote_workspace.rs
@@ -1773,7 +1773,11 @@ fn client_id_for(cx: &gpui::App, host: HostId, store_key: &str) -> Option<Worksp
 }
 
 fn launch_attempt(cx: &mut gpui::App, host: HostId, target: RemoteTarget) {
-    let label = target.to_string();
+    // Not `target.to_string()`: a `Profile` target spells itself as its config
+    // UUID, and this label is what the failure the strip shows names the
+    // machine (#485). The reconnect banner beside it already reads the live
+    // config for the same name, so the two disagreed mid-sentence.
+    let label = remote_connect::target_label(cx, &target);
     let header = match remote_connect::control_route(&target, cx) {
         Ok(header) => header,
         Err(e) => {
@@ -1833,7 +1837,7 @@ fn finish_attempt(
     target: &RemoteTarget,
     outcome: Result<(remote_connect::Connected, Vec<String>), String>,
 ) {
-    let label = target.to_string();
+    let label = remote_connect::target_label(cx, target);
     match outcome {
         Ok((connected, sent)) => {
             let restarted = server_restarted(cx, host, &connected.host);
diff --git a/src/ui/ssh_prompt.rs b/src/ui/ssh_prompt.rs
index 9a31c98b..64fe4966 100644
--- a/src/ui/ssh_prompt.rs
+++ b/src/ui/ssh_prompt.rs
@@ -689,7 +689,11 @@ impl Tty7App {
                 .flex_col()
                 .items_center()
                 .justify_start()
-                .pt(px(48.))
+                // Window-level now, so the old 48px — measured from the top of
+                // the terminal area — would ride up under the title bar. The
+                // same drop the switcher, the palette and the worktree prompt
+                // take.
+                .pt(px(crate::ui::switcher::CARD_TOP))
                 .child(stack)
                 .into_any_element(),
         )