diff --git a/roles/sshd/defaults/main.yml b/roles/sshd/defaults/main.yml
index 9854b2c..d4e07d1 100644
--- a/roles/sshd/defaults/main.yml
+++ b/roles/sshd/defaults/main.yml
@@ -6,7 +6,6 @@ ssh_allowed_networks:
 ssh_users: "jokester" # space separated if many
 ssh_config_dir: "/etc/ssh"
 sshd_config: "{{ ssh_config_dir }}/sshd_config"
-sshd_banner: "{{ ssh_config_dir }}/banner"
 sshd_binary: "/usr/sbin/sshd"
 ssh_authorized_keys_fallback_enabled: false
 ssh_authorized_keys_fallback_dir: "/etc/ssh/authorized_keys"
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index 2cc5ba8..caa8308 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -63,14 +63,6 @@
         mode: "0600"
       loop: "{{ ssh_users.split() }}"
 
-- name: Create an SSH banner
-  ansible.builtin.template:
-    src: templates/sshd_banner.j2
-    dest: "{{ sshd_banner }}"
-    owner: root
-    group: root
-    mode: "0644"
-
 - name: Remove motd on Debian
   ansible.builtin.file:
     path: /etc/motd
diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2
index b34257c..0b707e4 100644
--- a/roles/sshd/templates/sshd_config.j2
+++ b/roles/sshd/templates/sshd_config.j2
@@ -44,9 +44,6 @@ PermitUserEnvironment no
 SyslogFacility AUTH
 LogLevel VERBOSE
 
-# Banner
-Banner /etc/ssh/banner
-
 # SFTP
 Subsystem sftp internal-sftp
 
diff --git a/roles/zsh/tasks/user-setup.yml b/roles/zsh/tasks/user-setup.yml
index be35dba..005f341 100644
--- a/roles/zsh/tasks/user-setup.yml
+++ b/roles/zsh/tasks/user-setup.yml
@@ -7,6 +7,14 @@
     group: "{{ zsh_user }}"
     mode: "0600"
 
+- name: Setup .zprofile (login banner)
+  ansible.builtin.template:
+    src: zprofile.j2
+    dest: "{{ zsh_home }}/.zprofile"
+    owner: "{{ zsh_user }}"
+    group: "{{ zsh_user }}"
+    mode: "0600"
+
 - name: Setup zsh base config
   ansible.builtin.template:
     src: main.zshrc.j2
diff --git a/roles/sshd/templates/sshd_banner.j2 b/roles/zsh/templates/zprofile.j2
similarity index 95%
rename from roles/sshd/templates/sshd_banner.j2
rename to roles/zsh/templates/zprofile.j2
index ac7f3f7..29f8c50 100644
--- a/roles/sshd/templates/sshd_banner.j2
+++ b/roles/zsh/templates/zprofile.j2
@@ -1,3 +1,8 @@
+# {{ ansible_managed }}
+# Login banner - shown once per interactive login shell (before .zshrc / prompt)
+
+if [[ -o interactive ]]; then
+  cat <<'ANSIBLE_BANNER_END'
 {% if ansible_host == 'andromeda' %}
 *******************************************
  Beep beep-wooOOoo! Brrrp! Zzt zzt-whirl!
@@ -67,3 +72,5 @@ JEDI LOST - UNKNOWN STAR SYSTEM
 {% if ansible_hostname is defined %}
 {{ group_names | first }}: {{ ansible_hostname }}
 {% endif %}
+ANSIBLE_BANNER_END
+fi