diff --git a/hosts/www/openssh.nix b/hosts/www/openssh.nix
index 288b5d3..a16c870 100644
--- a/hosts/www/openssh.nix
+++ b/hosts/www/openssh.nix
@@ -8,8 +8,8 @@
       isSystemUser = true;
       group = "deploy";
       openssh.authorizedKeys.keys = [
-        "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35LG+xuDaoHQ2bYD4eRc3P6Cl3JVYntoP5Gu9R+mZC deploy@www.berlin.ccc.de production"
-        "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www-staging/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjjLtnGf7w5D/ON+P2HpMZ5HA2fWp5YSQMGMuu5CjUt deploy@www.berlin.ccc.de staging"
+        "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTUmrD0RMS0atfreGYjobnxBhppqo5XDEOUkLgUMWpD deploy@www.berlin.ccc.de production"
+        "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www-staging/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIenjEIMaOclgb+vg/LZf2P/eF9J1MaAHpSlYpmtKToB deploy@www.berlin.ccc.de staging"
       ];
     };
     groups.deploy = { };
diff --git a/secrets/id_ed25519_www-production.age b/secrets/id_ed25519_www-production.age
new file mode 100644
index 0000000..d0388d2
Binary files /dev/null and b/secrets/id_ed25519_www-production.age differ
diff --git a/secrets/id_ed25519_www-staging.age b/secrets/id_ed25519_www-staging.age
new file mode 100644
index 0000000..fd9096d
Binary files /dev/null and b/secrets/id_ed25519_www-staging.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 91c10ac..f343c2c 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -63,6 +63,8 @@ in
     _dav
   ];
   "www-staging-htpasswd.age".publicKeys = xengi ++ [ _www ];
+  "id_ed25519_www-staging.age".publicKeys = xengi;
+  "id_ed25519_www-production.age".publicKeys = xengi;
   "caldav-export-config.age".publicKeys = xengi ++ [ _www ];
   "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
   "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];