diff --git a/ssh/authorized_keys/mac-mini.pub b/ssh/authorized_keys/mac-mini.pub
new file mode 100644
index 0000000..1eb1922
--- /dev/null
+++ b/ssh/authorized_keys/mac-mini.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMtgjgpljZcu98NOW1ibry8ZBQSoUg0IaxK8iW10w2+ d.toro.v@pm.me
diff --git a/ssh/deploy-keys.sh b/ssh/deploy-keys.sh
new file mode 100644
index 0000000..4050944
--- /dev/null
+++ b/ssh/deploy-keys.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+# deploy-keys.sh — deploy workstation SSH pubkeys to hubris + all LXCs
+#
+# Run from hubris (PVE host) as root.
+# Reads keys from /opt/homelab-context/ssh/authorized_keys/*.pub
+# and appends them to /root/.ssh/authorized_keys in each running LXC,
+# and to /etc/pve/priv/authorized_keys on hubris.
+#
+# Idempotent — skips keys already present.
+
+set -euo pipefail
+
+KEYS_DIR="/opt/homelab-context/ssh/authorized_keys"
+
+if ! [ -d "$KEYS_DIR" ]; then
+  echo "ERROR: $KEYS_DIR not found. Is homelab context synced?"
+  exit 1
+fi
+
+# Collect all pubkeys into a single variable, one per line
+ALL_KEYS=""
+for f in "$KEYS_DIR"/*.pub; do
+  [ -f "$f" ] || continue
+  key=$(cat "$f" | head -1)
+  ALL_KEYS="${ALL_KEYS}${key}
+"
+done
+
+if [ -z "$ALL_KEYS" ]; then
+  echo "ERROR: no .pub files found in $KEYS_DIR"
+  exit 1
+fi
+
+echo "= Deploying SSH keys to hubris ="
+AUTH_FILE="/etc/pve/priv/authorized_keys"
+touch "$AUTH_FILE"
+added=0
+while IFS= read -r key; do
+  [ -z "$key" ] && continue
+  if ! grep -qF "$key" "$AUTH_FILE" 2>/dev/null; then
+    echo "  + Adding key to hubris: ${key:0:40}..."
+    echo "$key" >> "$AUTH_FILE"
+    added=$((added + 1))
+  fi
+done <<< "$ALL_KEYS"
+echo "  hubris: $added key(s) added"
+
+# Deploy to LXCs
+echo ""
+echo "= Deploying SSH keys to LXCs ="
+
+# pct list output: VMID Status Lock Name
+pct list | tail -n +2 | while read -r vmid status _ name; do
+  if [ "$status" != "running" ]; then
+    echo "  SKIP $name ($vmid): status=$status"
+    continue
+  fi
+
+  echo "  -> $name ($vmid)"
+
+  # Ensure .ssh directory exists
+  pct exec "$vmid" -- mkdir -p /root/.ssh 2>/dev/null
+
+  # For each key, check if already present, append if not
+  while IFS= read -r key; do
+    [ -z "$key" ] && continue
+    if ! pct exec "$vmid" -- grep -qF "$key" /root/.ssh/authorized_keys 2>/dev/null; then
+      echo "     + ${key:0:40}..."
+      # Use tee to append (pct exec preserves stdin)
+      echo "$key" | pct exec "$vmid" -- tee -a /root/.ssh/authorized_keys >/dev/null 2>&1
+    fi
+  done <<< "$ALL_KEYS"
+
+  # Fix permissions
+  pct exec "$vmid" -- chmod 600 /root/.ssh/authorized_keys 2>/dev/null || true
+  pct exec "$vmid" -- chmod 700 /root/.ssh 2>/dev/null || true
+
+  echo "  <- $name done"
+done
+
+echo ""
+echo "=== Deploy complete ==="
+echo "Keys deployed. Test from any workstation with:"
+echo "  ssh root@<lxc-ip>"
\ No newline at end of file