Bitbucket is moving SSH to ssh.bitbucket.org

Bitbucket Cloud is moving git over SSH from bitbucket.org to a new hostname, ssh.bitbucket.org. If you clone, fetch or push Bitbucket repositories over SSH, every one of those remotes needs the new address. This post covers what is changing, who it affects, and what Plexus 1.3.1 does about it.

What Bitbucket is changing, and when

Atlassian's announcement splits Bitbucket's traffic in two. bitbucket.org will serve only HTTPS: the website, the API and git over HTTPS. Git over SSH moves to ssh.bitbucket.org.

The original deadline was 12 November 2026. Atlassian updated the announcement on 21 October 2026 with a grace period. From 12 November, SSH on bitbucket.org is blocked during scheduled "brownout" windows that start at 15 minutes and grow to three hours. On 10 December 2026, it is switched off for good. During a brownout, and for good after 10 December, a fetch, pull or push to git@bitbucket.org: fails.

Atlassian asks SSH users to do four things:

• change each SSH remote to git@ssh.bitbucket.org:<workspace>/<repo>.git;
• trust the new host in ~/.ssh/known_hosts;
• update CI/CD pipelines, deployment scripts and any other automation that uses SSH;
• allow ssh.bitbucket.org on port 22 through firewalls that restrict outbound SSH.

Who is affected

Only SSH remotes. A remote that starts with https://bitbucket.org/ keeps working as it does today. That includes every repository you cloned from Plexus's repository search, because those clones use HTTPS with your Bitbucket connection.

What Plexus 1.3.1 does

It recognises the new host. Plexus decides which remotes are Bitbucket by their address, so on 1.3.0 a remote on ssh.bitbucket.org would have lost its pull requests, CI status and Open on Bitbucket. It would also have stopped matching the same project on your other machines for cross-device sync. In 1.3.1 those all keep working, whether a project has switched or not.

It tells you which projects need the change. If any project still has an SSH remote on bitbucket.org, a notice says so, with Review and Not now. Review lists every remote that would change, with its current and new address. It also offers to add Bitbucket's published host keys for ssh.bitbucket.org to your known_hosts. That matters more inside Plexus than in a terminal. The first time ssh meets a new host it asks whether you trust it. Plexus's background fetches and the commands an agent runs in a session have no way to answer that question, so they would simply fail.

It changes nothing until you click Update. Your remotes are in your repository's own configuration, and known_hosts decides which servers every ssh client on your machine trusts. Neither is ours to change without asking, so Plexus asks.

The host keys Plexus adds are built into the app. Atlassian says the new hostname uses the same host keys as bitbucket.org. On 22 October 2026 we checked that ourselves: ssh.bitbucket.org already answers, and it serves the same keys as bitbucket.org, matching Atlassian's published list. Plexus never asks the network for the keys at the moment you click. Recording whatever key answers would trust anyone who could intercept that connection.

Plexus never edits ~/.ssh/config. If your setup routes Bitbucket through a Host alias, a Host bitbucket.org block or a git insteadOf rule, the dialog shows you the exact line to change.

Doing it yourself

If you'd rather switch by hand, it is one command per remote, run in each repository:

git remote set-url origin git@ssh.bitbucket.org:<workspace>/<repo>.git

Then trust the new host, either by connecting once and checking the fingerprint ssh shows, or by adding the published keys to known_hosts. The docs have the three key lines, their fingerprints and how to switch back.

Plexus only looks after the repositories on your machine. Your CI, deploy scripts and firewall rules are still on Atlassian's list above.

If something about the move doesn't work the way this post says, tell us through Feedback in the app.