diff --git a/servers/tools-pve/asr-pipeline/asrpipe/config.py b/servers/tools-pve/asr-pipeline/asrpipe/config.py
index 58a72b8..7a1512a 100644
--- a/servers/tools-pve/asr-pipeline/asrpipe/config.py
+++ b/servers/tools-pve/asr-pipeline/asrpipe/config.py
@@ -205,11 +205,26 @@ class _SettingAttr:
         instance.__dict__.pop(self.override_attr, None)
 
 
+def _default_vault_path() -> Path:
+    state_vault = _state_db_path().parent / "vault"
+    if (state_vault / ".git").exists():
+        return state_vault
+    env_vault = _env("ASR_VAULT", "")
+    if env_vault:
+        p = Path(env_vault)
+        if (p / ".git").exists() or not state_vault.exists():
+            return p
+    return Path.home() / "obsidian-vault"
+
+
 @dataclass
 class Config:
     # ---- paths ----------------------------------------------------------
-    vault: Path = field(default_factory=lambda: Path(
-        _env("ASR_VAULT", str(Path.home() / "obsidian-vault"))))
+    vault = _SettingAttr(
+        "vault_dir",
+        lambda: str(_default_vault_path()),
+        lambda s: Path(s),
+    )
     obsidian: Path = field(default_factory=lambda: Path(
         _env("ASR_WORKSPACE", str(ROOT))))
     root: Path = ROOT
diff --git a/servers/tools-pve/asr-pipeline/asrpipe/vault.py b/servers/tools-pve/asr-pipeline/asrpipe/vault.py
index a1aa790..e32159a 100644
--- a/servers/tools-pve/asr-pipeline/asrpipe/vault.py
+++ b/servers/tools-pve/asr-pipeline/asrpipe/vault.py
@@ -10,6 +10,7 @@ Ported from the legacy shell implementation with its hard-won details preserved:
 """
 from __future__ import annotations
 
+import os
 import re
 import subprocess
 import tempfile
@@ -90,10 +91,23 @@ def update_pending(date: str, title: str, path: Path) -> None:
 
 
 def _git(*args, check=False) -> subprocess.CompletedProcess:
+    env = dict(os.environ)
+    for key_candidate in (
+        CFG.state_dir / "ssh" / "id_ed25519_gitea",
+        Path("/state/ssh/id_ed25519_gitea"),
+        Path("/root/.ssh/id_ed25519_gitea"),
+        Path.home() / ".ssh" / "id_ed25519_gitea",
+    ):
+        if key_candidate.exists():
+            env.setdefault(
+                "GIT_SSH_COMMAND",
+                f"ssh -i {key_candidate} -o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes",
+            )
+            break
     return subprocess.run(
         ["git", "-c", f"safe.directory={CFG.vault}", *args],
         cwd=CFG.vault, capture_output=True,
-        text=True, timeout=180, check=check,
+        text=True, timeout=180, check=check, env=env,
     )