diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58cb4996..7b960767 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Pin codex setup to `rust-v0.118.0` for security and reproducibility; update config to `wire_api = "responses"` (#663)
 - Propagate headers and environment variables through OpenCode MCP adapter with defensive copies to prevent mutation (#622)
 - Fix `apm install` hanging indefinitely when corporate firewalls silently drop SSH packets by setting `GIT_SSH_COMMAND` with `ConnectTimeout=30` (#652)
+- Fix `apm install` falling back to HTTPS after SSH times out so installs complete on networks that block port 22 (#653)
 - Fix `apm compile --target claude` silently skipping dependency instructions stored in `.github/instructions/` (#631)
 
 ### Changed
diff --git a/docs/src/content/docs/getting-started/installation.md b/docs/src/content/docs/getting-started/installation.md
index f40da1fa..1d220f03 100644
--- a/docs/src/content/docs/getting-started/installation.md
+++ b/docs/src/content/docs/getting-started/installation.md
@@ -149,6 +149,24 @@ mkdir -p ~/bin
 
 See [Authentication -- Troubleshooting](../authentication/#troubleshooting) for token setup, SSO authorization, and diagnosing auth failures.
 
+### `apm install` hangs or times out on corporate networks (SSH blocked)
+
+Some corporate firewalls silently drop SSH packets, causing `apm install` to stall indefinitely when APM tries to clone a dependency over SSH.
+
+APM automatically sets a 30-second SSH connection timeout (`GIT_SSH_COMMAND` with `-o ConnectTimeout=30`) and falls back to HTTPS when the SSH attempt fails. If installs are still slow, you can force HTTPS clones by prepending the dependency URL with `https://`:
+
+```yaml
+# apm.yml
+dependencies:
+  - https://github.com/org/repo
+```
+
+If the problem persists, set `APM_DEBUG=1` for detailed clone diagnostics:
+
+```bash
+APM_DEBUG=1 apm install
+```
+
 ### File access errors on Windows (antivirus / endpoint protection)
 
 If `apm install` fails with `The process cannot access the file because it is being used by another process`, your antivirus or endpoint protection software is likely scanning temp files during installation.
diff --git a/packages/apm-guide/.apm/skills/apm-usage/troubleshooting.md b/packages/apm-guide/.apm/skills/apm-usage/troubleshooting.md
index 2411cfce..402af078 100644
--- a/packages/apm-guide/.apm/skills/apm-usage/troubleshooting.md
+++ b/packages/apm-guide/.apm/skills/apm-usage/troubleshooting.md
@@ -2,6 +2,7 @@
 
 | Problem | Fix |
 |---------|-----|
+| `apm install` hangs or stalls (SSH blocked by firewall) | APM now times out SSH after 30 seconds and retries over HTTPS automatically. To force HTTPS always, prefix the dependency URL with `https://` in `apm.yml`. Use `APM_DEBUG=1` for clone diagnostics. |
 | `apm: command not found` | Install APM: `curl -sSL https://aka.ms/apm-unix \| sh` (macOS/Linux) or `irm https://aka.ms/apm-windows \| iex` (Windows). Ensure `/usr/local/bin` is in `$PATH`. |
 | Authentication errors (401/403) | Set the correct token. Run `apm install --verbose` to see which token source is used. See [Authentication](./authentication.md). |
 | File collision on install | A local file conflicts with a dependency file. Use `--force` to overwrite, or rename the local file. |