diff --git a/SKILL.md b/SKILL.md
index bc85cc6..53743ab 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -127,6 +127,7 @@ Default domain: `warden.test`. Configure in `~/.warden/.env` (`WARDEN_SERVICE_DO
 | Webmail (Mailpit) | `https://webmail.warden.test` |
 | Portainer | `https://portainer.warden.test` |
 | phpMyAdmin | `https://phpmyadmin.warden.test` |
+| SSH Tunnel | `tunnel.warden.test:2222` (DB clients) |
 
 **Email (Mailpit):** No SMTP config needed. Warden routes sendmail to Mailpit. All emails at `https://webmail.warden.test`.
 
diff --git a/references/global-services.md b/references/global-services.md
index 7735cb3..8abc788 100644
--- a/references/global-services.md
+++ b/references/global-services.md
@@ -8,9 +8,25 @@
 | Webmail (Mailpit) | https://webmail.warden.test |
 | Portainer | https://portainer.warden.test |
 | phpMyAdmin | https://phpmyadmin.warden.test |
+| SSH Tunnel | `tunnel.warden.test:2222` (for DB clients) |
 
 Per-project: RabbitMQ, Elasticsearch, OpenSearch at `https://{service}.{project}.test`
 
+## SSH Tunnel (Database Clients)
+
+Warden runs an SSH tunnel service for connecting external database clients (TablePlus, Sequel Pro, PhpStorm, DBeaver, etc.) to project database containers.
+
+| Setting | Value |
+|---------|-------|
+| SSH Host | `tunnel.warden.test` |
+| SSH Port | `2222` |
+| SSH User | `user` |
+| SSH Key | `~/.warden/tunnel/ssh_key` |
+| MySQL Host | container name from `warden env ps` |
+| MySQL Port | `3306` |
+
+Auto-configured during `warden install`. No manual setup needed.
+
 ## Global Configuration (~/.warden/.env)
 
 | Variable | Default | Description |