diff --git a/deploy b/deploy
new file mode 100755
index 0000000..615d40d
--- /dev/null
+++ b/deploy
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Deploy the jupiter NixOS config.
+#
+#   ./deploy install <ip>     first install onto a fresh box (nixos-anywhere).
+#                             Wipes the OS disk. Ships the sops host key.
+#   ./deploy [switch] [host]  rebuild + activate on a running jupiter (default).
+#   ./deploy boot   [host]    stage for next boot, don't activate now.
+#   ./deploy test   [host]    activate without adding a boot entry.
+#
+# Runs from a non-NixOS host too (nixos-rebuild / nixos-anywhere via `nix run`).
+set -euo pipefail
+
+REPO="$(cd "$(dirname "$0")" && pwd)"
+cd "$REPO"
+export PATH="/nix/var/nix/profiles/default/bin:$PATH"
+
+HOSTKEY="$HOME/.config/homelab/jupiter/ssh_host_ed25519_key"
+
+cmd="${1:-switch}"
+case "$cmd" in
+  switch|boot|test|install) shift || true ;;
+  *) cmd="switch" ;;
+esac
+
+case "$cmd" in
+  install)
+    host="${1:-}"
+    [ -n "$host" ] || { echo "usage: ./deploy install <ip-or-host>" >&2; exit 1; }
+    [ -f "$HOSTKEY" ] || { echo "missing host key: $HOSTKEY" >&2; exit 1; }
+
+    # Stage the pre-generated SSH host key so sops can decrypt on boot #1.
+    stage="$(mktemp -d)"
+    trap 'rm -rf "$stage"' EXIT
+    install -Dm600 "$HOSTKEY"      "$stage/etc/ssh/ssh_host_ed25519_key"
+    install -Dm644 "$HOSTKEY.pub"  "$stage/etc/ssh/ssh_host_ed25519_key.pub"
+
+    echo ">> nixos-anywhere onto root@$host (OS disk WILL be wiped)"
+    nix run github:nix-community/nixos-anywhere -- \
+      --flake ".#jupiter" \
+      --extra-files "$stage" \
+      --generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \
+      --target-host "root@$host"
+    ;;
+
+  switch|boot|test)
+    host="${1:-jupiter}"
+    echo ">> nixos-rebuild $cmd on darman@$host"
+    nix run nixpkgs#nixos-rebuild -- "$cmd" \
+      --flake ".#jupiter" \
+      --target-host "darman@$host" \
+      --use-remote-sudo
+    ;;
+esac
diff --git a/jupiter/services.nix b/jupiter/services.nix
index 69ca975..54a9a50 100644
--- a/jupiter/services.nix
+++ b/jupiter/services.nix
@@ -27,9 +27,9 @@
     isNormalUser = true;
     description = "darman";
     extraGroups = [ "wheel" "networkmanager" "docker" ];
-    # Replace with your real public key. Password login for ssh is disabled below.
+    # Password login for ssh is disabled below — these keys are the only way in.
     openssh.authorizedKeys.keys = [
-      # "ssh-ed25519 AAAA... darman@laptop"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
     ];
   };