diff --git a/src/ssh.rs b/src/ssh.rs
index 14eebc0..bd3d14f 100644
--- a/src/ssh.rs
+++ b/src/ssh.rs
@@ -15,12 +15,25 @@ pub fn build(profile: &Profile) -> Command {
         "-o",
         "BatchMode=yes",
         "-o",
+        "StrictHostKeyChecking=accept-new",
+        "-o",
+        "LogLevel=ERROR",
+        "-o",
         "ExitOnForwardFailure=yes",
         "-o",
         "ConnectTimeout=10",
         "-o",
+        "ServerAliveCountMax=3",
+        "-o",
+        "ControlMaster=no",
+        "-o",
+        "ControlPath=none",
+        "-o",
+        "ClearAllForwardings=yes",
+        "-o",
         &format!("ServerAliveInterval={}", profile.keepalive),
         "-N",
+        "-T",
     ]);
 
     let (jumps, target) = profile.ssh_target();
@@ -31,6 +44,7 @@ pub fn build(profile: &Profile) -> Command {
     cmd.arg("-p").arg(profile.ssh_port.to_string());
     if let Some(identity) = &profile.identity {
         cmd.arg("-i").arg(identity);
+        cmd.args(["-o", "IdentitiesOnly=yes"]);
     }
     if let Some(user) = &profile.user {
         cmd.arg("-l").arg(user);
@@ -86,4 +100,30 @@ mod tests {
         let l_idx = args.iter().position(|a| a == "-L").expect("-L present");
         assert_eq!(args[l_idx + 1], "5432:db.internal:5432");
     }
+
+    #[test]
+    fn identities_only_set_when_identity_given() {
+        let p = Profile::new(
+            "t".into(),
+            &ProfileEdits {
+                local:    Some("5432:db.internal:5432".into()),
+                via:      Some(vec!["jumpbox".into()]),
+                identity: Some("/home/me/.ssh/id_ed25519".into()),
+                ..Default::default()
+            },
+        )
+        .unwrap();
+        let args: Vec<String> = build(&p).get_args().map(|a| a.to_string_lossy().into_owned()).collect();
+        let i_idx = args.iter().position(|a| a == "-i").expect("-i present");
+        assert_eq!(args[i_idx + 1], "/home/me/.ssh/id_ed25519");
+        assert!(args.windows(2).any(|w| w == ["-o", "IdentitiesOnly=yes"]));
+    }
+
+    #[test]
+    fn identities_only_absent_without_identity() {
+        let p = profile_with(vec!["jumpbox"]);
+        assert!(p.identity.is_none());
+        let args: Vec<String> = build(&p).get_args().map(|a| a.to_string_lossy().into_owned()).collect();
+        assert!(!args.windows(2).any(|w| w == ["-o", "IdentitiesOnly=yes"]));
+    }
 }