diff --git a/common.nix b/common.nix
index 7f501be..f5d99e4 100644
--- a/common.nix
+++ b/common.nix
@@ -23,8 +23,11 @@ let
   # is to run nix on the server over SSH and hand the resulting closure to
   # --store-path, which skips eval and build entirely. Same lantian substituter
   # as services/prebuild.nix, and --out-link keeps a gc root on the server so
-  # `clean` there can't reap the closure mid-copy.
-  remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(sudo ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} --option extra-substituters https://attic.xuyh0120.win/lantian --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && sudo nix copy --from ssh://fred@nordhammer.it $NEW && sudo nixos-rebuild switch --store-path $NEW && ${post}'";
+  # `clean` there can't reap the closure mid-copy. SSH and the copy run as
+  # fred, not root: root has no key on the server, and require-sigs = false
+  # below is a daemon setting, so the daemon takes the unsigned closure from an
+  # untrusted user just fine. Only the activation needs sudo.
+  remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} --option extra-substituters https://attic.xuyh0120.win/lantian --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW && sudo nixos-rebuild switch --store-path $NEW && ${post}'";
 in
 {
   imports = [