diff --git a/Assistant/WebApp/Configurators/Ssh.hs b/Assistant/WebApp/Configurators/Ssh.hs
index 96a99fad7f..cc66b6a391 100644
--- a/Assistant/WebApp/Configurators/Ssh.hs
+++ b/Assistant/WebApp/Configurators/Ssh.hs
@@ -365,12 +365,6 @@ sshErr sshinput msg
  - Depending on the SshInput, avoids using a password, or uses a
  - cached password. ssh is coaxed to use git-annex as SSH_ASKPASS
  - to get the password.
- -
- - Note that ssh will only use SSH_ASKPASS when DISPLAY is set and there
- - is no controlling terminal. On Unix, that is set up when the assistant
- - starts, by calling createSession. On Windows, all of stdin, stdout, and
- - stderr must be disconnected from the terminal. This is accomplished
- - by always providing input on stdin.
  -}
 sshAuthTranscript :: SshInput -> [String] -> (Maybe String) -> Assistant (String, Bool)
 sshAuthTranscript sshinput opts input = case inputAuthMethod sshinput of
@@ -383,8 +377,20 @@ sshAuthTranscript sshinput opts input = case inputAuthMethod sshinput of
 	login = getLogin sshinput
 	geti f = maybe "" T.unpack (f sshinput)
 
-	go extraopts environ = processTranscript' "ssh" (extraopts ++ opts) environ $
-		Just (fromMaybe "" input)
+	go extraopts environ = processTranscript' 
+		(askPass environ) "ssh" (extraopts ++ opts)
+		-- Always provide stdin, even when empty.
+		(Just (fromMaybe "" input))
+
+ 	{- ssh will only use SSH_ASKPASS when DISPLAY is set and there
+	 - is no controlling terminal. -}
+	askPass environ p = p
+		{ env = environ
+#if MIN_VERSION_process(1,3,0)
+		, detach_console = True
+		, new_session = True
+#endif
+		}
 
 	setupAskPass = do
 		program <- liftIO programPath
@@ -398,10 +404,6 @@ sshAuthTranscript sshinput opts input = case inputAuthMethod sshinput of
 				let environ' = addEntries
 					[ ("SSH_ASKPASS", program)
 					, (sshAskPassEnv, passfile)
-					-- ssh does not use SSH_ASKPASS
-					-- unless DISPLAY is set, and
-					-- there is no controlling
-					-- terminal.
 					, ("DISPLAY", ":0")
 					] environ
 				go [passwordprompts 1] (Just environ')
diff --git a/Build/EvilLinker.hs b/Build/EvilLinker.hs
index fa260edabc..97f218fd59 100644
--- a/Build/EvilLinker.hs
+++ b/Build/EvilLinker.hs
@@ -21,6 +21,7 @@ import Data.List
 
 import Utility.Monad
 import Utility.Process hiding (env)
+import qualified Utility.Process
 import Utility.Env
 
 data CmdParams = CmdParams
@@ -126,7 +127,7 @@ getOutput c ps environ = do
 	putStrLn $ unwords [c, show ps]
 	systemenviron <- getEnvironment
 	let environ' = fromMaybe [] environ ++ systemenviron
-	out@(_, ok) <- processTranscript' c ps (Just environ') Nothing
+	out@(_, ok) <- processTranscript' (\p -> p { Utility.Process.env = Just environ' }) c ps Nothing
 	putStrLn $ unwords [c, "finished", show ok]
 	return out
 
diff --git a/Utility/Process.hs b/Utility/Process.hs
index 2059948117..ae9ce49c8c 100644
--- a/Utility/Process.hs
+++ b/Utility/Process.hs
@@ -172,22 +172,21 @@ createBackgroundProcess p a = a =<< createProcess p
 -- returns a transcript combining its stdout and stderr, and
 -- whether it succeeded or failed.
 processTranscript :: String -> [String] -> (Maybe String) -> IO (String, Bool)
-processTranscript cmd opts input = processTranscript' cmd opts Nothing input
+processTranscript = processTranscript' id
 
-processTranscript' :: String -> [String] -> Maybe [(String, String)] -> (Maybe String) -> IO (String, Bool)
-processTranscript' cmd opts environ input = do
+processTranscript' :: (CreateProcess -> CreateProcess) -> String -> [String] -> Maybe String -> IO (String, Bool)
+processTranscript' modproc cmd opts input = do
 #ifndef mingw32_HOST_OS
 {- This implementation interleves stdout and stderr in exactly the order
  - the process writes them. -}
 	(readf, writef) <- System.Posix.IO.createPipe
 	readh <- System.Posix.IO.fdToHandle readf
 	writeh <- System.Posix.IO.fdToHandle writef
-	p@(_, _, _, pid) <- createProcess $
+	p@(_, _, _, pid) <- createProcess $ modproc $
 		(proc cmd opts)
 			{ std_in = if isJust input then CreatePipe else Inherit
 			, std_out = UseHandle writeh
 			, std_err = UseHandle writeh
-			, env = environ
 			}
 	hClose writeh
 
@@ -199,12 +198,11 @@ processTranscript' cmd opts environ input = do
 	return (transcript, ok)
 #else
 {- This implementation for Windows puts stderr after stdout. -}
-	p@(_, _, _, pid) <- createProcess $
+	p@(_, _, _, pid) <- createProcess $ modproc $
 		(proc cmd opts)
 			{ std_in = if isJust input then CreatePipe else Inherit
 			, std_out = CreatePipe
 			, std_err = CreatePipe
-			, env = environ
 			}
 
 	getout <- mkreader (stdoutHandle p)
diff --git a/debian/changelog b/debian/changelog
index 165426c41b..99f1f26aee 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,7 @@
 git-annex (5.20150825) UNRELEASED; urgency=medium
 
   * Fix Windows build to work with ghc 7.10.
+  * webapp: Fix support for entering password when setting up a ssh remote.
 
  -- Joey Hess <id@joeyh.name>  Tue, 01 Sep 2015 14:46:18 -0700
 
diff --git a/doc/bugs/windows_ssh_webapp_password_entry_broken.mdwn b/doc/bugs/windows_ssh_webapp_password_entry_broken.mdwn
index e734e007b8..0ab236095f 100644
--- a/doc/bugs/windows_ssh_webapp_password_entry_broken.mdwn
+++ b/doc/bugs/windows_ssh_webapp_password_entry_broken.mdwn
@@ -3,3 +3,5 @@ entering a password when adding a ssh remote.
 
 Using ssh on windows with an existing remote does work. So as a workaround,
 set up a passwordless ssh key that can log into the ssh server. --[[Joey]]
+
+> [[fixed|done]] --[[Joey]]
diff --git a/git-annex.cabal b/git-annex.cabal
index 7800a8b5a1..c9103d9d53 100644
--- a/git-annex.cabal
+++ b/git-annex.cabal
@@ -157,7 +157,8 @@ Executable git-annex
     GHC-Options: -O2
 
   if (os(windows))
-    Build-Depends: Win32, Win32-extras, unix-compat (>= 0.4.1.3), setenv
+    Build-Depends: Win32, Win32-extras, unix-compat (>= 0.4.1.3), setenv,
+      process (>= 1.3.0.0)
   else
     Build-Depends: unix
     -- Need to list these because they're generated from .hsc files.