diff --git a/README.md b/README.md
index 655d105..3e73e1c 100644
--- a/README.md
+++ b/README.md
@@ -211,5 +211,12 @@ Stored in the `hantim` Gitea org for direct use in CI workflows:
 | Name | Type | Purpose |
 |---|---|---|
 | `DEPLOY_HOST` | Variable | Server IP or hostname |
+| `DEPLOY_HOST_KEY` | Variable | Server SSH host public key (for host key pinning) |
 | `DEPLOY_SSH_KEY` | Secret | SSH private key for the deploy user |
 | `CI_REGISTRY_TOKEN` | Secret | Gitea token for Docker registry login |
+
+After reprovisioning hantim (new host key), update `DEPLOY_HOST_KEY`:
+
+```bash
+ssh-keyscan -t ed25519 hantim.net 2>/dev/null
+```