diff --git a/deploy/nixos/live.nix b/deploy/nixos/live.nix
index 1f7de50..54962c1 100644
--- a/deploy/nixos/live.nix
+++ b/deploy/nixos/live.nix
@@ -205,8 +205,8 @@ in
   # Clean /tmp on boot to prevent stale Nix build artifacts from filling disk
   boot.tmp.cleanOnBoot = true;
 
-  # Allow SSH with password for initial setup on the live system
-  services.openssh.settings.PasswordAuthentication = lib.mkForce true;
+  # SSH password auth disabled — machines are provisioned with SSH keys.
+  # Base configuration.nix sets PasswordAuthentication = false.
 
   # Serial port udev rules — generic permissions for all models
   services.udev.extraRules = lib.mkAfter (''