diff --git a/krebs/default.nix b/krebs/default.nix
index 175b02050..bfd6175d9 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -84,6 +84,7 @@ let out = {
 
       cat<<EOF
       # put following into config.krebs.hosts.$system:
+      ssh.privkey.path = <secrets/ssh.$key_type>;
       ssh.pubkey = $(echo $pubkey | jq -R .);
       EOF
     '';