diff --git a/flake.nix b/flake.nix
index f595174..b63e10c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -206,6 +206,15 @@
           _module.args.self = self;
           _module.args.inputs = self.inputs;
         }
+        # ssh keys
+        ({ config, ... }: {
+          users.users.root.openssh.authorizedKeys.keyFiles = [
+          # master key
+            ./nixos/assets/ssh/palo_rsa.pub
+            # backup key
+            "${config.clanCore.clanDir}/machines/chungus/facts/syncoid.ssh.id_ed25519.pub"
+          ];
+        })
         # configure nix
         ({ pkgs, ... }:
           {
diff --git a/nixos/machines/chungus/sync-syncoid.nix b/nixos/machines/chungus/sync-syncoid.nix
index 666cbfe..16cd4b5 100644
--- a/nixos/machines/chungus/sync-syncoid.nix
+++ b/nixos/machines/chungus/sync-syncoid.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ pkgs, config, ... }:
 {
 
   clanCore.facts.services.syncoid = {
@@ -7,7 +7,7 @@
     generator.path = with pkgs; [ coreutils openssh ];
     generator.script = ''
       ssh-keygen -t ed25519 -N "" -f $secrets/syncoid.ssh.id_ed25519
-      mv $secrets/ssh.id_ed25519.pub $facts/syncoid.ssh.id_ed25519.pub
+      mv $secrets/syncoid.ssh.id_ed25519.pub $facts/syncoid.ssh.id_ed25519.pub
     '';
   };