diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 5a2aab6..4b1ca89 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -12,7 +12,9 @@ jobs:
       - name: Setup deploy SSH key
         run: |
           mkdir -p ~/.ssh
-          # install -m 600 /dev/stdin ~/.ssh/id_ed25519 <<< "${{ secrets.DEPLOY_SSH_KEY }}"
+          # Dedicated key file so we never overwrite the runner user's own key.
+          # nix/deploy.nix pins this via `-i ~/.ssh/gebos_deploy`.
+          install -m 600 /dev/stdin ~/.ssh/gebos_deploy <<< "${{ secrets.DEPLOY_SSH_KEY }}"
           ssh-keyscan -H db.gebos.online app.gebos.online ingest.gebos.online >> ~/.ssh/known_hosts 2>/dev/null || true
 
       - name: Build all closures
diff --git a/nix/deploy.nix b/nix/deploy.nix
index cbbdaf8..ec0f027 100644
--- a/nix/deploy.nix
+++ b/nix/deploy.nix
@@ -12,7 +12,17 @@ let
   };
 in
 {
-  sshOpts = [ "-o" "StrictHostKeyChecking=accept-new" ];
+  # The Gitea runner has a global `Host * IdentityFile ~/.ssh/larsnolden` in its
+  # ~/.ssh/config (a passphrase-locked key). `-F none` makes ssh ignore that
+  # config so it doesn't offer the wrong key; `-i` + IdentitiesOnly pins the
+  # dedicated deploy key the workflow installs. Applies to both `nix copy` and
+  # the activation SSH.
+  sshOpts = [
+    "-F" "none"
+    "-i" "~/.ssh/gebos_deploy"
+    "-o" "IdentitiesOnly=yes"
+    "-o" "StrictHostKeyChecking=accept-new"
+  ];
   autoRollback = true;
   magicRollback = true;