diff --git a/nix/modules/orchestrator-host.nix b/nix/modules/orchestrator-host.nix
index 8829d22..6af9553 100644
--- a/nix/modules/orchestrator-host.nix
+++ b/nix/modules/orchestrator-host.nix
@@ -89,9 +89,10 @@ in
     programs.nix-ld.enable = true;
     programs.nix-ld.libraries = with pkgs; [ stdenv.cc.cc.lib zlib openssl curl glibc ];
 
-    # ---- the toolbox every agent on this box gets ----------------------------------------
-    # Bar for adding something: an agent doing ordinary work would otherwise waste a turn
-    # discovering it is absent.
+    # ---- the toolbox every agent (and every operator ssh session) on this box gets ----------
+    # Bar for adding something: an agent or an operator doing ordinary work would otherwise waste
+    # a turn discovering it is absent. Installed system-wide, so it is on PATH for BOTH root and
+    # loops via /run/current-system/sw/bin (which the forced PATH below keeps for every user).
     environment.systemPackages = with pkgs; [
       git tmux python3 jq curl cacert
       gnused gawk coreutils gnugrep findutils util-linux nettools openssh
@@ -102,8 +103,19 @@ in
       dnsutils socat netcat-gnu iproute2 iputils
       openssl gnumake gcc pkg-config
       yq-go diffutils patch rsync bubblewrap
+      # Editors: `vim` ships `vi` too, so both names resolve for anyone who types either.
+      # `nano` comes from the base system. EDITOR is set below so git/systemctl/visudo agree.
+      vim nano
+      # `sqlite` is not a nicety here: Drone's build/step logs live in its sqlite volume and the
+      # runbook (and /cc-ci-status) tell you to read them there; without it every such check
+      # needed an ad-hoc `nix-shell -p sqlite`.
+      sqlite
+      bat bc moreutils pv man-pages
     ];
 
+    # So `git commit`, `systemctl edit`, `visudo` etc. open something that exists on this host.
+    environment.variables.EDITOR = "vim";
+
     # ---- ssh config for the loops user: `ssh cc-ci` = the CI server (root) -----------------
     # Written only if absent so a manual customisation survives rebuilds.
     system.activationScripts.loopsSshConfig = ''