diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/AbstractGitCommand.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/AbstractGitCommand.java
index eb8a5c25c9..af5df2574c 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/AbstractGitCommand.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/AbstractGitCommand.java
@@ -35,6 +35,9 @@ public abstract class AbstractGitCommand extends BaseCommand {
   @Argument(index = 0, metaVar = "PROJECT.git", required = true, usage = "project name")
   protected ProjectControl projectControl;
 
+  @Inject
+  private SshScope sshScope;
+
   @Inject
   private GitRepositoryManager repoManager;
 
@@ -56,7 +59,7 @@ public abstract class AbstractGitCommand extends BaseCommand {
   @Override
   public void start(final Environment env) {
     Context ctx = context.subContext(newSession(), context.getCommandLine());
-    final Context old = SshScope.set(ctx);
+    final Context old = sshScope.set(ctx);
     try {
       startThread(new ProjectCommandRunnable() {
         @Override
@@ -76,7 +79,7 @@ public abstract class AbstractGitCommand extends BaseCommand {
         }
       });
     } finally {
-      SshScope.set(old);
+      sshScope.set(old);
     }
   }
 
diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/BaseCommand.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/BaseCommand.java
index e6ae613d2a..2b4543b47a 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/BaseCommand.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/BaseCommand.java
@@ -72,6 +72,9 @@ public abstract class BaseCommand implements Command {
 
   private ExitCallback exit;
 
+  @Inject
+  private SshScope sshScope;
+
   @Inject
   private CmdLineParser.Factory cmdLineParserFactory;
 
@@ -390,11 +393,11 @@ public abstract class BaseCommand implements Command {
     @Override
     public void cancel() {
       synchronized (this) {
-        final Context old = SshScope.set(context);
+        final Context old = sshScope.set(context);
         try {
           onExit(STATUS_CANCEL);
         } finally {
-          SshScope.set(old);
+          sshScope.set(old);
         }
       }
     }
@@ -405,7 +408,7 @@ public abstract class BaseCommand implements Command {
         final Thread thisThread = Thread.currentThread();
         final String thisName = thisThread.getName();
         int rc = 0;
-        final Context old = SshScope.set(context);
+        final Context old = sshScope.set(context);
         try {
           context.started = System.currentTimeMillis();
           thisThread.setName("SSH " + taskName);
@@ -439,7 +442,7 @@ public abstract class BaseCommand implements Command {
           try {
             onExit(rc);
           } finally {
-            SshScope.set(old);
+            sshScope.set(old);
             thisThread.setName(thisName);
           }
         }
diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/CommandFactoryProvider.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/CommandFactoryProvider.java
index 66e6addf03..8eaa829294 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/CommandFactoryProvider.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/CommandFactoryProvider.java
@@ -53,6 +53,7 @@ class CommandFactoryProvider implements Provider<CommandFactory> {
 
   private final DispatchCommandProvider dispatcher;
   private final SshLog log;
+  private final SshScope sshScope;
   private final ScheduledExecutorService startExecutor;
   private final Executor destroyExecutor;
 
@@ -60,9 +61,10 @@ class CommandFactoryProvider implements Provider<CommandFactory> {
   CommandFactoryProvider(
       @CommandName(Commands.ROOT) final DispatchCommandProvider d,
       @GerritServerConfig final Config cfg, final WorkQueue workQueue,
-      final SshLog l) {
+      final SshLog l, final SshScope s) {
     dispatcher = d;
     log = l;
+    sshScope = s;
 
     int threads = cfg.getInt("sshd","commandStartThreads", 2);
     startExecutor = workQueue.createQueue(threads, "SshCommandStart");
@@ -145,7 +147,7 @@ class CommandFactoryProvider implements Provider<CommandFactory> {
 
     private void onStart() throws IOException {
       synchronized (this) {
-        final Context old = SshScope.set(ctx);
+        final Context old = sshScope.set(ctx);
         try {
           cmd = dispatcher.get();
           cmd.setArguments(argv);
@@ -167,7 +169,7 @@ class CommandFactoryProvider implements Provider<CommandFactory> {
           });
           cmd.start(env);
         } finally {
-          SshScope.set(old);
+          sshScope.set(old);
         }
       }
     }
@@ -211,14 +213,14 @@ class CommandFactoryProvider implements Provider<CommandFactory> {
     private void onDestroy() {
       synchronized (this) {
         if (cmd != null) {
-          final Context old = SshScope.set(ctx);
+          final Context old = sshScope.set(ctx);
           try {
             cmd.destroy();
             log(BaseCommand.STATUS_CANCEL);
           } finally {
             ctx = null;
             cmd = null;
-            SshScope.set(old);
+            sshScope.set(old);
           }
         }
       }
diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/DatabasePubKeyAuth.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/DatabasePubKeyAuth.java
index a96a661766..0b31a653e4 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/DatabasePubKeyAuth.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/DatabasePubKeyAuth.java
@@ -65,6 +65,7 @@ class DatabasePubKeyAuth implements PublickeyAuthenticator {
   private final IdentifiedUser.GenericFactory userFactory;
   private final PeerDaemonUser.Factory peerFactory;
   private final Config config;
+  private final SshScope sshScope;
   private final Set<PublicKey> myHostKeys;
   private volatile PeerKeyCache peerKeyCache;
 
@@ -72,12 +73,13 @@ class DatabasePubKeyAuth implements PublickeyAuthenticator {
   DatabasePubKeyAuth(final SshKeyCacheImpl skc, final SshLog l,
       final IdentifiedUser.GenericFactory uf, final PeerDaemonUser.Factory pf,
       final SitePaths site, final KeyPairProvider hostKeyProvider,
-      final @GerritServerConfig Config cfg) {
+      final @GerritServerConfig Config cfg, final SshScope s) {
     sshKeyCache = skc;
     sshLog = l;
     userFactory = uf;
     peerFactory = pf;
     config = cfg;
+    sshScope = s;
     myHostKeys = myHostKeys(hostKeyProvider);
     peerKeyCache = new PeerKeyCache(site.peer_keys);
   }
@@ -172,11 +174,11 @@ class DatabasePubKeyAuth implements PublickeyAuthenticator {
       // a close listener to record a logout event.
       //
       Context ctx = new Context(sd, null);
-      Context old = SshScope.set(ctx);
+      Context old = sshScope.set(ctx);
       try {
         sshLog.onLogin();
       } finally {
-        SshScope.set(old);
+        sshScope.set(old);
       }
 
       session.getIoSession().getCloseFuture().addListener(
@@ -184,11 +186,11 @@ class DatabasePubKeyAuth implements PublickeyAuthenticator {
             @Override
             public void operationComplete(IoFuture future) {
               final Context ctx = new Context(sd, null);
-              final Context old = SshScope.set(ctx);
+              final Context old = sshScope.set(ctx);
               try {
                 sshLog.onLogout();
               } finally {
-                SshScope.set(old);
+                sshScope.set(old);
               }
             }
           });
diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/NoShell.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/NoShell.java
index be513b33a2..5ea2f6bdaa 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/NoShell.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/NoShell.java
@@ -58,6 +58,7 @@ class NoShell implements Factory<Command> {
 
   static class SendMessage implements Command, SessionAware {
     private final Provider<MessageFactory> messageFactory;
+    private final SshScope sshScope;
 
     private InputStream in;
     private OutputStream out;
@@ -66,8 +67,9 @@ class NoShell implements Factory<Command> {
     private Context context;
 
     @Inject
-    SendMessage(Provider<MessageFactory> messageFactory) {
+    SendMessage(Provider<MessageFactory> messageFactory, SshScope sshScope) {
       this.messageFactory = messageFactory;
+      this.sshScope = sshScope;
     }
 
     public void setInputStream(final InputStream in) {
@@ -91,12 +93,12 @@ class NoShell implements Factory<Command> {
     }
 
     public void start(final Environment env) throws IOException {
-      Context old = SshScope.set(context);
+      Context old = sshScope.set(context);
       String message;
       try {
         message = messageFactory.get().getMessage();
       } finally {
-        SshScope.set(old);
+        sshScope.set(old);
       }
       err.write(Constants.encode(message.toString()));
       err.flush();
diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshModule.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshModule.java
index dcb7c07d96..72fe6b040c 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshModule.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshModule.java
@@ -82,6 +82,7 @@ public class SshModule extends FactoryModule {
   protected void configure() {
     bindScope(RequestScoped.class, SshScope.REQUEST);
     bind(RequestScopePropagator.class).to(SshScope.Propagator.class);
+    bind(SshScope.class).in(SINGLETON);
 
     configureRequestScope();
     configureCmdLineParser();
diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshScope.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshScope.java
index 92609b5235..8cd501e6ca 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshScope.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshScope.java
@@ -123,7 +123,7 @@ class SshScope {
     return ctx;
   }
 
-  static Context set(Context ctx) {
+  Context set(Context ctx) {
     Context old = current.get();
     current.set(ctx);
     return old;
@@ -149,7 +149,4 @@ class SshScope {
       return "SshScopes.REQUEST";
     }
   };
-
-  private SshScope() {
-  }
 }
diff --git a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SuExec.java b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SuExec.java
index b4c59a84cb..33459c2529 100644
--- a/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SuExec.java
+++ b/gerrit-sshd/src/main/java/com/google/gerrit/sshd/SuExec.java
@@ -43,6 +43,7 @@ import java.util.concurrent.atomic.AtomicReference;
  * key, or a key on this daemon's peer host key ring.
  */
 public final class SuExec extends BaseCommand {
+  private final SshScope sshScope;
   private final DispatchCommandProvider dispatcher;
 
   private Provider<CurrentUser> caller;
@@ -62,10 +63,12 @@ public final class SuExec extends BaseCommand {
   private final AtomicReference<Command> atomicCmd;
 
   @Inject
-  SuExec(@CommandName(Commands.ROOT) final DispatchCommandProvider dispatcher,
+  SuExec(final SshScope sshScope,
+      @CommandName(Commands.ROOT) final DispatchCommandProvider dispatcher,
       final Provider<CurrentUser> caller, final Provider<SshSession> session,
       final IdentifiedUser.GenericFactory userFactory,
       final SshScope.Context callingContext) {
+    this.sshScope = sshScope;
     this.dispatcher = dispatcher;
     this.caller = caller;
     this.session = session;
@@ -81,7 +84,7 @@ public final class SuExec extends BaseCommand {
         parseCommandLine();
 
         final Context ctx = callingContext.subContext(newSession(), join(args));
-        final Context old = SshScope.set(ctx);
+        final Context old = sshScope.set(ctx);
         try {
           final BaseCommand cmd = dispatcher.get();
           cmd.setArguments(args.toArray(new String[args.size()]));
@@ -89,7 +92,7 @@ public final class SuExec extends BaseCommand {
           atomicCmd.set(cmd);
           cmd.start(env);
         } finally {
-          SshScope.set(old);
+          sshScope.set(old);
         }
 
       } else {