diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index b814be1b..f5751b8c 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -1543,8 +1543,8 @@ checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
 name = "data-studio-agent"
-version = "0.1.8"
-source = "git+https://github.com/geek-fun/data-studio-agent.git?tag=v0.1.8#504fe2d7aef2a8ce829f34a43620cafffbb902c8"
+version = "0.1.9"
+source = "git+https://github.com/geek-fun/data-studio-agent.git?tag=v0.1.9#7e6610bd421d5acbadf64558aa954bc27b175e38"
 dependencies = [
  "async-openai",
  "async-trait",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 998d8b96..9c664b4f 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -88,7 +88,7 @@ log = "0.4"
 futures = "0.3"
 rand = "0.8"
 # data-studio-agent: pinned to latest release tag.
-data-studio-agent = { git = "https://github.com/geek-fun/data-studio-agent.git", tag = "v0.1.8" }
+data-studio-agent = { git = "https://github.com/geek-fun/data-studio-agent.git", tag = "v0.1.9" }
 
 # Archive extraction (JRE downloads)
 flate2 = "1.0"
diff --git a/src/components/connections/ServerCard.vue b/src/components/connections/ServerCard.vue
index e4223582..e492ca66 100644
--- a/src/components/connections/ServerCard.vue
+++ b/src/components/connections/ServerCard.vue
@@ -13,8 +13,9 @@ import {
   DropdownMenuTrigger,
 } from '@/components/ui/dropdown-menu'
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip'
+import { ProBadge } from '@/components/upgrade'
 import { useDatabaseIcon } from '@/composables/useDatabaseIcon'
-import { ConnectionStatus, DatabaseType, formatServerVersion, getConnectionStrategy } from '@/store'
+import { ConnectionStatus, DatabaseType, formatServerVersion, getConnectionStrategy, useEntitlementStore } from '@/store'
 
 const props = defineProps<{
   connection: ServerConnection
@@ -31,6 +32,7 @@ const emit = defineEmits<{
 }>()
 
 const { t } = useI18n()
+const entitlementStore = useEntitlementStore()
 const { getDatabaseIcon, getDatabaseColor } = useDatabaseIcon()
 
 const statusColor = computed(() => {
@@ -225,6 +227,20 @@ const connectTooltip = computed(() =>
         <Badge v-if="connection.ssl" variant="outline" class="text-xs">
           SSL
         </Badge>
+        <TooltipProvider v-if="connection.sshTunnel?.enabled">
+          <Tooltip>
+            <TooltipTrigger as-child>
+              <Badge variant="outline" class="text-xs">
+                <span class="i-carbon-locked mr-0.5 h-3 w-3" />
+                SSH
+                <ProBadge v-if="!entitlementStore.isLocalUltimate" size="xs" class="ml-1" />
+              </Badge>
+            </TooltipTrigger>
+            <TooltipContent>
+              <p>SSH tunnel</p>
+            </TooltipContent>
+          </Tooltip>
+        </TooltipProvider>
       </div>
 
       <!-- Actions -->
diff --git a/src/components/connections/ServerFormDialog.vue b/src/components/connections/ServerFormDialog.vue
index ba3fe8c7..748e7025 100644
--- a/src/components/connections/ServerFormDialog.vue
+++ b/src/components/connections/ServerFormDialog.vue
@@ -3,8 +3,10 @@ import type { OracleConnectionOptions, ServerConnection } from '@/store'
 import type { DatabaseFileAssessment } from '@/utils/databaseFiles'
 import { invoke } from '@tauri-apps/api/core'
 import { open as openDialog } from '@tauri-apps/plugin-dialog'
+import { openUrl } from '@tauri-apps/plugin-opener'
 import { computed, ref, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
+import { UPGRADE_URL } from '@/common'
 import { Button } from '@/components/ui/button'
 import { SearchableSelect } from '@/components/ui/combobox'
 import { Dialog, DialogContent, DialogDescription, DialogTitle } from '@/components/ui/dialog'
@@ -19,7 +21,6 @@ import {
   SelectValue,
 } from '@/components/ui/select'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
-import { openUpgradeDialog } from '@/components/upgrade'
 import { useDatabaseIcon } from '@/composables/useDatabaseIcon'
 import { useDownloadEvents } from '@/composables/useDownloadEvents'
 import { toast } from '@/composables/useNotifications'
@@ -191,7 +192,8 @@ async function runStep(step: StepDef): Promise<boolean> {
 
 function toggleSsh(checked: boolean) {
   if (checked && !entitlementStore.isLocalUltimate) {
-    openUpgradeDialog('ssh_tunnel')
+    // usage-side feature — send to the pricing site (matches dockit)
+    openUrl(UPGRADE_URL)
     return
   }
   if (!formData.value.sshTunnel) {
diff --git a/src/pages/ConnectionsPage.vue b/src/pages/ConnectionsPage.vue
index d6fcb613..48449178 100644
--- a/src/pages/ConnectionsPage.vue
+++ b/src/pages/ConnectionsPage.vue
@@ -1,8 +1,10 @@
 <script setup lang="ts">
 import type { ServerConnection } from '@/store'
+import { openUrl } from '@tauri-apps/plugin-opener'
 import { computed, onMounted, ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { useRouter } from 'vue-router'
+import { UPGRADE_URL } from '@/common'
 import { ServerCard, ServerFormDialog } from '@/components/connections'
 import ConnectingModal from '@/components/connections/ConnectingModal.vue'
 import AppLayout from '@/components/layout/AppLayout.vue'
@@ -11,13 +13,14 @@ import { Card } from '@/components/ui/card'
 import { DestructiveConfirmDialog } from '@/components/ui/destructive-confirm-dialog'
 import { Input } from '@/components/ui/input'
 import { toast } from '@/composables/useNotifications'
-import { ConnectionStatus, useConnectionStore } from '@/store'
+import { ConnectionStatus, useConnectionStore, useEntitlementStore } from '@/store'
 
 const MIN_LOADING_TIME = 1500
 
 const { t } = useI18n()
 const router = useRouter()
 const connectionStore = useConnectionStore()
+const entitlementStore = useEntitlementStore()
 
 const searchQuery = ref('')
 const viewMode = ref<'grid' | 'list'>('grid')
@@ -57,6 +60,9 @@ function handleAddConnection() {
 }
 
 function handleEditConnection(connection: ServerConnection) {
+  if (!guardSshConnection(connection)) {
+    return
+  }
   editingConnection.value = connection
   isFormDialogOpen.value = true
 }
@@ -124,8 +130,20 @@ async function establishConnection(connection: ServerConnection, navigateOnSucce
   }
 }
 
+// an SSH-bound saved connection is only operable with Ultimate — instead of
+// attempting a connect that dies with a raw 403, route to the pricing site
+function guardSshConnection(connection: ServerConnection): boolean {
+  if (entitlementStore.isLocalUltimate || !connection.sshTunnel?.enabled)
+    return true
+  openUrl(UPGRADE_URL)
+  return false
+}
+
 async function handleConnect(connection: ServerConnection) {
   connectError.value = null
+  if (!guardSshConnection(connection)) {
+    return
+  }
   if (!connection.id) {
     return
   }
@@ -146,6 +164,9 @@ async function handleConnect(connection: ServerConnection) {
 
 async function handleDoubleClick(connection: ServerConnection) {
   connectError.value = null
+  if (!guardSshConnection(connection)) {
+    return
+  }
   if (!connection.id) {
     return
   }
@@ -164,6 +185,9 @@ async function handleDoubleClick(connection: ServerConnection) {
 }
 
 function handleDeleteConnection(connection: ServerConnection) {
+  if (!guardSshConnection(connection)) {
+    return
+  }
   connectionToDelete.value = connection
   deleteDialogOpen.value = true
 }
@@ -177,6 +201,9 @@ async function confirmDelete() {
 }
 
 function handleDuplicateConnection(connection: ServerConnection) {
+  if (!guardSshConnection(connection)) {
+    return
+  }
   editingConnection.value = {
     ...connection,
     id: undefined,