diff --git a/git-open b/git-open
index 7dcae92..ed9cc2c 100755
--- a/git-open
+++ b/git-open
@@ -152,7 +152,13 @@ else
   if [[ -e "$ssh_config" ]]; then
     domain_resolv=$(ssh_resolve "$domain")
     if [[ -n "$domain_resolv" ]]; then
-      domain="$domain_resolv"
+      # Don't use ssh.* subdomains for web URLs (e.g., ssh.github.com)
+      if [[ $domain != ssh.* && $domain_resolv == ssh.* ]]; then
+        # Keep the original domain instead of using ssh.* subdomain
+        :
+      else
+        domain="$domain_resolv"
+      fi
     fi
   fi
 fi
diff --git a/test/git-open.bats b/test/git-open.bats
index 887d6a7..8715031 100755
--- a/test/git-open.bats
+++ b/test/git-open.bats
@@ -356,6 +356,26 @@ setup() {
   assert_output "https://override.zero.com/user/repo"
 }
 
+@test "sshconfig: ssh subdomain endpoints should not be used for web URLs" {
+  # When SSH config maps github.com -> ssh.github.com (for SSH over HTTPS port 443),
+  # the web URL should still use github.com, not ssh.github.com
+  # See: https://docs.github.com/en/authentication/troubleshooting-ssh/using-ssh-over-the-https-port
+  create_ssh_sandbox
+
+  # Add github.com -> ssh.github.com mapping to SSH config
+  echo "
+Host github.com
+  HostName ssh.github.com
+  Port 443
+  User git
+" >> $ssh_config
+
+  git remote set-url origin "git@github.com:rails/rails.git"
+  run ../git-open
+  # Should use github.com for web URL, NOT ssh.github.com
+  assert_output "https://github.com/rails/rails"
+}
+
 ##
 ## Bitbucket
 ##