diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4b1ca89..78258d9 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -20,6 +20,24 @@ jobs:
       - name: Build all closures
         run: nix flake check --no-build
 
+      # TEMPORARY: diagnose the SSH auth failure to db-host. Prints only the
+      # PUBLIC key fingerprint (no private material) and the ssh negotiation.
+      # Remove once deploys succeed.
+      - name: Debug SSH to db-host
+        run: |
+          echo "== runner =="; whoami; echo "HOME=$HOME"
+          echo "== installed deploy PUBLIC key (compare to nix/hosts/common.nix:26-27) =="
+          ssh-keygen -y -f ~/.ssh/gebos_deploy -P "" < /dev/null \
+            || echo ">>> KEY UNREADABLE: encrypted (has passphrase) or missing"
+          echo "deploy            should be ...Z+SU"
+          echo "me@larsnolden.com should be ...cdd0"
+          echo "== ssh auth negotiation =="
+          ssh -vvv -F none -i ~/.ssh/gebos_deploy -o IdentitiesOnly=yes \
+              -o StrictHostKeyChecking=accept-new -o BatchMode=yes \
+              deploy@db.gebos.online 'echo CONNECTED as $(whoami)@$(hostname)' 2>&1 \
+            | grep -Ei 'CONNECTED|denied|Server accepts|Offering|Authenticated|not accessible|Host key|incorrect passphrase|No such' \
+            || true
+
       # Order matters: db schema migrations are part of db-host's activation,
       # so it must land first. App-host's Supabase compose stack expects the
       # schemas to exist. mqtt-ingest only needs the network paths to db-host.