diff --git a/home/workmac.nix b/home/workmac.nix
index 0a9cc65..0f8fd43 100644
--- a/home/workmac.nix
+++ b/home/workmac.nix
@@ -35,9 +35,11 @@ in
     # defaults in bottom match block "*"
     # TODO: common config for desktop as well
     # multiplexer, e.g. to avoid rate limiting on jumphost usage
-    serverAliveInterval = 60;
+    serverAliveInterval = 10;
+    serverAliveCountMax = 2; # 2 strikes and you're out
     controlMaster = "auto";
-    controlPersist = "4h";
+    # not too long, due to the frequent keepalives
+    controlPersist = "1h";
     # ssh host config
     matchBlocks = {
 
@@ -45,7 +47,6 @@ in
       "*" = {
         extraOptions = {
           IdentityAgent = "\"~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock\"";
-          #ControlPath = "/tmp/ssh_mux_%h_%p_%r";
         };
       };
 
@@ -107,7 +108,7 @@ in
         "0"
         "-D"
         "1080"
-        "-oServerAliveInterval=60"
+        "-oServerAliveInterval=30"
         "-oControlMaster=no"
         "-N"
         "vpn-whq.services.fcio.net"