diff --git a/common.nix b/common.nix
index 504f2e7..06004de 100644
--- a/common.nix
+++ b/common.nix
@@ -191,6 +191,17 @@ in
       supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
     }];
 
+  # nix.buildMachines runs from the daemon, i.e. as root, so it needs root's own
+  # key — fred's doesn't count, and ssh refuses a key file owned by another user
+  # outright. Copying fred's (root can read it anyway, so this leaks nothing new)
+  # beats committing a private key to a repo the hosts fetch over plain HTTPS.
+  # C+ re-copies on every activation, so rotating fred's key rotates root's too.
+  systemd.tmpfiles.rules = lib.mkIf
+    (lib.elem config.networking.hostName [ "FredOS-Gaming" "FredOS-Macbook" ]) [
+      "d /root/.ssh 0700 root root -"
+      "C+ /root/.ssh/id_ed25519 0600 root root - /home/fred/.ssh/id_ed25519"
+    ];
+
   # Accept unsigned paths copied back from the remote builder.
   nix.extraOptions =
     lib.mkIf (config.networking.hostName != "FredOS-Mediaserver") ''