diff --git a/roles/alpine/tasks/main.yml b/roles/alpine/tasks/main.yml
index 626ebe6..6cce486 100644
--- a/roles/alpine/tasks/main.yml
+++ b/roles/alpine/tasks/main.yml
@@ -115,3 +115,9 @@
   template:
     dest: /etc/motd
     src: motd.j2
+
+- name: Set authorized SSH keys
+  authorized_key:
+    user: root
+    exclusive: true
+    key: "{{ ssh_keys | join('\n') }}"
diff --git a/roles/facts/tasks/main.yml b/roles/facts/tasks/main.yml
index f49d5ff..536242a 100644
--- a/roles/facts/tasks/main.yml
+++ b/roles/facts/tasks/main.yml
@@ -1,5 +1,6 @@
 # Make expensive lookups to NetBox once for later reference by any host.
 - when: lookup("env", "NETBOX_API") != ""
+  delegate_to: localhost
   block:
     - name: Lookup networks and prefixes
       set_fact:
@@ -21,5 +22,27 @@
           loop: '{{ cluster.custom_fields.services | map(attribute="id") | map("string") }}'
 
 - name: Fetch passwords
+  delegate_to: localhost
   set_fact:
     password: '{{ lookup("passwordstore", ("vm/" if is_virtual else "host/")~inventory_hostname, returnall=true, missing="empty") | from_yaml }}'
+
+- name: Get SSH keys
+  delegate_to: localhost
+  check_mode: false
+  run_once: true
+  block:
+    - name: Get GPG key IDs
+      shell: cat ${PASSWORD_STORE_DIR:-~/.password-store}/.gpg-id
+      changed_when: false
+      register: gpg_ids
+
+    - name: Export public SSH keys
+      shell: echo "$(gpg --export-ssh-key {{ item }} | cut -d ' ' -f 1,2) $(gpg --list-keys --with-colons {{ item }} | sed -n 's@uid:.*<\(.*\)>.*@\1@p')"
+      loop: '{{ gpg_ids.stdout_lines }}'
+      changed_when: false
+      register: ssh_export
+
+    - name: Set SSH keys to deploy on servers
+      set_fact:
+        ssh_keys: '{{ ssh_export.results | map(attribute="stdout") }}'
+      failed_when: not ssh_keys # something must be terribly wrong so let’s not lock everyone out