diff --git a/opentofu/vr1-dc0-substrate/main.tf b/opentofu/vr1-dc0-substrate/main.tf
index f0cf6f9..24600b2 100644
--- a/opentofu/vr1-dc0-substrate/main.tf
+++ b/opentofu/vr1-dc0-substrate/main.tf
@@ -12,7 +12,13 @@
 provider "libvirt" {
   # qemu+ssh to vvr1-dc0 over the transit. Key auth + known_hosts verified out of band
   # (NO no_verify). The IP is MEASURED after the outer apply (hard rule 2).
-  uri = "qemu+ssh://${var.vvr1_dc0_ssh_user}@${var.vvr1_dc0_transit_ip}/system"
+  # keyfile + sshauth are REQUIRED URI params (measured 2026-07-20, first real dial):
+  # the provider's Go ssh transport ignores ~/.ssh/config and default identities
+  # ("attempted methods [none]"). known_hosts: ALL key types must be present --
+  # a single accept-new ED25519 entry fails the handshake with "knownhosts: key
+  # mismatch" (seed via ssh-keyscan, fingerprint cross-checked against the
+  # accept-new-trusted entry).
+  uri = "qemu+ssh://${var.vvr1_dc0_ssh_user}@${var.vvr1_dc0_transit_ip}/system?keyfile=${var.vvr1_dc0_ssh_keyfile}&sshauth=privkey"
 }
 
 # Inner storage pool (backs the node + edge disks) -- created inside vvr1-dc0 at the
diff --git a/opentofu/vr1-dc0-substrate/variables.tf b/opentofu/vr1-dc0-substrate/variables.tf
index 8c1d539..ecf5321 100644
--- a/opentofu/vr1-dc0-substrate/variables.tf
+++ b/opentofu/vr1-dc0-substrate/variables.tf
@@ -12,6 +12,11 @@
   default     = "jessea123"
 }
 
+variable "vvr1_dc0_ssh_keyfile" {
+  description = "PATH (on the EXECUTING host, i.e. voffice1 per D-128) to the dc0 private key for the qemu+ssh provider. A path, never key material (D-126 secrets boundary). REQUIRED: measured 2026-07-20 that the provider's ssh dial reads NEITHER ~/.ssh/config nor default identity paths -- without an explicit keyfile URI param it attempts no auth methods at all."
+  type        = string
+}
+
 variable "inner_pool_path" {
   description = "Directory path INSIDE vvr1-dc0 for the inner libvirt storage pool that backs the node/edge disks (created by the bootstrap step)."
   type        = string