diff --git a/cli/lucli/tests/_fixtures/deploy/sshd/README.md b/cli/lucli/tests/_fixtures/deploy/sshd/README.md
new file mode 100644
index 0000000000..8db2efb2a9
--- /dev/null
+++ b/cli/lucli/tests/_fixtures/deploy/sshd/README.md
@@ -0,0 +1,15 @@
+# SSH test fixture
+
+Two openssh-server containers on host ports 22022 and 22023, user `deploy`
+with sudo and password auth disabled. Used by SshClientSpec (Task 6+) and
+SshPoolSpec (Task 9).
+
+## Start / Stop
+
+```bash
+bash tools/deploy-sshd-up.sh
+bash tools/deploy-sshd-down.sh
+```
+
+`test_key` is a deterministic ed25519 keypair committed to the repo — it
+has NO production value and exists only for test reproducibility.
diff --git a/cli/lucli/tests/_fixtures/deploy/sshd/authorized_keys b/cli/lucli/tests/_fixtures/deploy/sshd/authorized_keys
new file mode 100644
index 0000000000..0ba002dc60
--- /dev/null
+++ b/cli/lucli/tests/_fixtures/deploy/sshd/authorized_keys
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test
diff --git a/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml b/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml
new file mode 100644
index 0000000000..e441eedc94
--- /dev/null
+++ b/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml
@@ -0,0 +1,24 @@
+services:
+  sshd1:
+    image: linuxserver/openssh-server:latest
+    environment:
+      PUBLIC_KEY_FILE: /keys/authorized_keys
+      USER_NAME: deploy
+      SUDO_ACCESS: "true"
+      PASSWORD_ACCESS: "false"
+    volumes:
+      - ./authorized_keys:/keys/authorized_keys:ro
+    ports:
+      - "22022:2222"
+
+  sshd2:
+    image: linuxserver/openssh-server:latest
+    environment:
+      PUBLIC_KEY_FILE: /keys/authorized_keys
+      USER_NAME: deploy
+      SUDO_ACCESS: "true"
+      PASSWORD_ACCESS: "false"
+    volumes:
+      - ./authorized_keys:/keys/authorized_keys:ro
+    ports:
+      - "22023:2222"
diff --git a/cli/lucli/tests/_fixtures/deploy/sshd/test_key b/cli/lucli/tests/_fixtures/deploy/sshd/test_key
new file mode 100644
index 0000000000..91cfca4756
--- /dev/null
+++ b/cli/lucli/tests/_fixtures/deploy/sshd/test_key
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBA/Hc+Sf9s1+nSsKeTqpaecILoX4OJWND4PdWf7SGv4QAAAJim5WLOpuVi
+zgAAAAtzc2gtZWQyNTUxOQAAACBA/Hc+Sf9s1+nSsKeTqpaecILoX4OJWND4PdWf7SGv4Q
+AAAEA7Lvr2A4p8d/fupWxM/MobsLDDSUaaOpzvnX83Wb5ukED8dz5J/2zX6dKwp5Oqlp5w
+guhfg4lY0Pg91Z/tIa/hAAAAEndoZWVscy1kZXBsb3ktdGVzdAECAw==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/cli/lucli/tests/_fixtures/deploy/sshd/test_key.pub b/cli/lucli/tests/_fixtures/deploy/sshd/test_key.pub
new file mode 100644
index 0000000000..0ba002dc60
--- /dev/null
+++ b/cli/lucli/tests/_fixtures/deploy/sshd/test_key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test
diff --git a/tools/deploy-sshd-down.sh b/tools/deploy-sshd-down.sh
new file mode 100755
index 0000000000..a5ebb16bb6
--- /dev/null
+++ b/tools/deploy-sshd-down.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+FIX_DIR="$(cd "$(dirname "$0")/.." && pwd)/cli/lucli/tests/_fixtures/deploy/sshd"
+docker compose -f "$FIX_DIR/docker-compose.yml" down
diff --git a/tools/deploy-sshd-up.sh b/tools/deploy-sshd-up.sh
new file mode 100755
index 0000000000..edaa301546
--- /dev/null
+++ b/tools/deploy-sshd-up.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+FIX_DIR="$(cd "$(dirname "$0")/.." && pwd)/cli/lucli/tests/_fixtures/deploy/sshd"
+docker compose -f "$FIX_DIR/docker-compose.yml" up -d
+sleep 5
diff --git a/web/sites/guides/astro.config.mjs b/web/sites/guides/astro.config.mjs
index 4199df5155..1ea888feb4 100644
--- a/web/sites/guides/astro.config.mjs
+++ b/web/sites/guides/astro.config.mjs
@@ -45,11 +45,19 @@ function buildSidebarForVersion(version) {
 	return {
 		label: version.label,
 		collapsed: version.collapsed,
-		items: groups.map((g) => ({
-			label: g.label,
-			collapsed: version.collapsed,
-			items: (g.items || []).map(normalizeItem).filter(Boolean),
-		})),
+		items: groups.map((g) => {
+			// Top-level entry with a link and no children → render as a leaf link,
+			// not a collapsible group. Without this, Starlight would wrap it as an
+			// empty group and drop the link entirely (Glossary hit this bug).
+			if (g.link && (!g.items || g.items.length === 0)) {
+				return { label: g.label, link: g.link };
+			}
+			return {
+				label: g.label,
+				collapsed: version.collapsed,
+				items: (g.items || []).map(normalizeItem).filter(Boolean),
+			};
+		}),
 	};
 }