diff --git a/entrypoint.sh b/entrypoint.sh
index 02de9cc..25db580 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -39,6 +39,23 @@ if [ ! -f "${HOME_DIR}/.profile" ] || ! grep -q 'DOCKER_HOST' "${HOME_DIR}/.prof
   chown developer:developer "${HOME_DIR}/.profile"
 fi
 
+# sshd does not forward container env to login shells. Mirror kube-injected
+# proxy vars into /etc/environment + a profile.d snippet (same path as DOCKER_HOST).
+proxy_env_file=/etc/profile.d/99-kube-proxy.sh
+: > "${proxy_env_file}"
+chmod 644 "${proxy_env_file}"
+for v in HTTP_PROXY HTTPS_PROXY http_proxy https_proxy NO_PROXY no_proxy ALL_PROXY all_proxy; do
+  val="${!v:-}"
+  [ -n "${val}" ] || continue
+  # Refresh /etc/environment line for this key.
+  if grep -q "^${v}=" /etc/environment 2>/dev/null; then
+    sed -i "s|^${v}=.*|${v}=${val}|" /etc/environment
+  else
+    echo "${v}=${val}" >> /etc/environment
+  fi
+  printf 'export %s=%q\n' "${v}" "${val}" >> "${proxy_env_file}"
+done
+
 # Tiny HTTP for TrinityIngress / health (Traefik terminates TLS).
 python3 -m http.server 8080 --bind 0.0.0.0 --directory /usr/share/devbox-http >/tmp/http-8080.log 2>&1 &