diff --git a/crates/navigator-bootstrap/src/docker.rs b/crates/navigator-bootstrap/src/docker.rs
index cddb049ba..c44197bfb 100644
--- a/crates/navigator-bootstrap/src/docker.rs
+++ b/crates/navigator-bootstrap/src/docker.rs
@@ -180,7 +180,7 @@ pub async fn find_gateway_container(docker: &Docker, port: Option<u16>) -> Resul
         1 => Ok(matches.into_iter().next().unwrap()),
         _ => Err(miette::miette!(
             "Found multiple openshell gateway containers: {}\n\
-             Pass --name <gateway-name> to select one.",
+             Specify the port in the endpoint URL to select one (e.g. https://host:8080).",
             matches.join(", ")
         )),
     }
diff --git a/crates/navigator-cli/src/run.rs b/crates/navigator-cli/src/run.rs
index 7ade911c5..d0f52e7d3 100644
--- a/crates/navigator-cli/src/run.rs
+++ b/crates/navigator-cli/src/run.rs
@@ -866,8 +866,9 @@ pub async fn gateway_add(
     local: bool,
 ) -> Result<()> {
     // If the endpoint starts with ssh://, parse it into an SSH destination
-    // and a gateway endpoint automatically.
-    // e.g. ssh://drew@spark:8080 -> remote="drew@spark", endpoint="https://spark:8080"
+    // and a gateway endpoint automatically.  The host is resolved via
+    // `ssh -G` so that SSH config aliases map to the real hostname/IP.
+    // e.g. ssh://drew@spark:8080 -> remote="drew@spark", endpoint="https://<resolved>:8080"
     let (endpoint, remote) = if endpoint.starts_with("ssh://") {
         if local {
             return Err(miette::miette!(
@@ -895,7 +896,11 @@ pub async fn gateway_add(
         } else {
             format!("{}@{host}", parsed.username())
         };
-        let https_endpoint = format!("https://{host}:{port}");
+        // Resolve the SSH host alias (e.g. ~/.ssh/config HostName) so the
+        // endpoint uses the actual hostname/IP that matches the TLS certificate
+        // SANs — consistent with the `gateway start` path.
+        let resolved = resolve_ssh_hostname(host);
+        let https_endpoint = format!("https://{resolved}:{port}");
 
         (https_endpoint, Some(ssh_dest))
     } else {