diff --git a/modules/git/cli_backend.go b/modules/git/cli_backend.go
index 885b3d41..0394403c 100644
--- a/modules/git/cli_backend.go
+++ b/modules/git/cli_backend.go
@@ -310,25 +310,24 @@ func prepareCLIAuth(auth *AuthMethod) ([]string, []string, func(), error) {
 		// an identity or passphrase. Overriding it unconditionally would bypass
 		// the user's core.sshCommand and GIT_SSH_COMMAND settings, including any
 		// host-key/known_hosts handling configured there.
-		if auth.KeyFile == "" && auth.KeyPassphrase == "" {
-			break
-		}
-		sshCommand := "ssh"
-		if auth.KeyFile != "" {
-			sshCommand += " -i " + shellQuote(auth.KeyFile) + " -o IdentitiesOnly=yes"
-		}
-		env = append(env, "GIT_SSH_COMMAND="+sshCommand)
-		if auth.KeyPassphrase != "" {
-			askPassPath, err := writeAskPassScript(auth.KeyPassphrase)
-			if err != nil {
-				return nil, nil, cleanup, err
+		if auth.KeyFile != "" || auth.KeyPassphrase != "" {
+			sshCommand := "ssh"
+			if auth.KeyFile != "" {
+				sshCommand += " -i " + shellQuote(auth.KeyFile) + " -o IdentitiesOnly=yes"
+			}
+			env = append(env, "GIT_SSH_COMMAND="+sshCommand)
+			if auth.KeyPassphrase != "" {
+				askPassPath, err := writeAskPassScript(auth.KeyPassphrase)
+				if err != nil {
+					return nil, nil, cleanup, err
+				}
+				cleanup = func() { _ = os.Remove(askPassPath) }
+				env = append(env,
+					"SSH_ASKPASS="+askPassPath,
+					"SSH_ASKPASS_REQUIRE=force",
+					"DISPLAY=tea",
+				)
 			}
-			cleanup = func() { _ = os.Remove(askPassPath) }
-			env = append(env,
-				"SSH_ASKPASS="+askPassPath,
-				"SSH_ASKPASS_REQUIRE=force",
-				"DISPLAY=tea",
-			)
 		}
 	}