diff --git a/debian/ssh_wrapper.sh b/debian/ssh_wrapper.sh
new file mode 100755
index 0000000..687ed87
--- /dev/null
+++ b/debian/ssh_wrapper.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# --- begin runfiles.bash initialization v2 ---
+# Copy-pasted from the Bazel Bash runfiles library v2.
+set -uo pipefail; f=bazel_tools/tools/bash/runfiles/runfiles.bash
+source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
+  source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
+  source "$0.runfiles/$f" 2>/dev/null || \
+  source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
+  source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
+  { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
+# --- end runfiles.bash initialization v2 ---
+
+LIB_PATH="$(rlocation ssh/usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0)"
+LIB_PATH="${LIB_PATH%/libcrypto.so.1.0.0}"
+export LD_LIBRARY_PATH="${LIB_PATH}"
+
+TOOL_PATH="$(rlocation ssh/%(TOOL))"
+
+exec "${TOOL_PATH}" "$@"