diff --git a/Assistant/WebApp/Configurators/Ssh.hs b/Assistant/WebApp/Configurators/Ssh.hs
index 708f094e99..c232cf7dd5 100644
--- a/Assistant/WebApp/Configurators/Ssh.hs
+++ b/Assistant/WebApp/Configurators/Ssh.hs
@@ -278,9 +278,9 @@ testServer sshinput@(SshInput { inputHostname = Just hn }) = do
 
 {- Runs a ssh command; if it fails shows the user the transcript,
  - and if it succeeds, runs an action. -}
-sshSetup :: [String] -> String -> Handler Html -> Handler Html
+sshSetup :: [String] -> Maybe String -> Handler Html -> Handler Html
 sshSetup opts input a = do
-	(transcript, ok) <- liftIO $ sshTranscript opts (Just input)
+	(transcript, ok) <- liftIO $ sshTranscript opts input
 	if ok
 		then a
 		else showSshErr transcript
@@ -383,7 +383,7 @@ prepSsh' newgcrypt origsshdata sshdata keypair a = sshSetup
 	 [ "-p", show (sshPort origsshdata)
 	 , genSshHost (sshHostName origsshdata) (sshUserName origsshdata)
 	 , remoteCommand
-	 ] "" (a sshdata)
+	 ] Nothing (a sshdata)
   where
 	remotedir = T.unpack $ sshDirectory sshdata
 	remoteCommand = shellWrap $ intercalate "&&" $ catMaybes
@@ -450,7 +450,7 @@ getMakeRsyncNetGCryptR :: SshData -> RepoKey -> Handler Html
 getMakeRsyncNetGCryptR sshdata NoRepoKey = whenGcryptInstalled $
 	withNewSecretKey $ getMakeRsyncNetGCryptR sshdata . RepoKey
 getMakeRsyncNetGCryptR sshdata (RepoKey keyid) = whenGcryptInstalled $
-	sshSetup [sshhost, gitinit] [] $ makeGCryptRepo keyid sshdata
+	sshSetup [sshhost, gitinit] Nothing $ makeGCryptRepo keyid sshdata
   where
 	sshhost = genSshHost (sshHostName sshdata) (sshUserName sshdata)
 	gitinit = "git init --bare " ++ T.unpack (sshDirectory sshdata)
@@ -498,7 +498,7 @@ prepRsyncNet sshinput reponame a = do
 		, genSshHost (sshHostName sshdata) (sshUserName sshdata)
 		, remotecommand
 		]
-	sshSetup sshopts (sshPubKey keypair) $ a sshdata
+	sshSetup sshopts (Just $ sshPubKey keypair) $ a sshdata
 
 isRsyncNet :: Maybe Text -> Bool
 isRsyncNet Nothing = False
diff --git a/debian/changelog b/debian/changelog
index ff1e9a09f2..b862d6a3cc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,8 @@ git-annex (5.20131231) UNRELEASED; urgency=medium
   * external special remote protocol: Added GETUUID.
   * Windows: Fix bug in direct mode merge code that could cause files
     in subdirectories to go missing.
+  * Windows: Avoid eating stdin when running ssh to add a authorized key,
+    since this is used for password prompting.
 
  -- Joey Hess <joeyh@debian.org>  Tue, 31 Dec 2013 13:41:18 -0400