From 16ea39811d0995eba56a419ab8fc31e4018dd21d Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Fri, 20 Mar 2026 16:31:54 -0400
Subject: [PATCH] document deploy host key variable in readme

---
 README.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/README.md b/README.md
index 655d105..3e73e1c 100644
--- a/README.md
+++ b/README.md
@@ -211,5 +211,12 @@ Stored in the `hantim` Gitea org for direct use in CI workflows:
 | Name | Type | Purpose |
 |---|---|---|
 | `DEPLOY_HOST` | Variable | Server IP or hostname |
+| `DEPLOY_HOST_KEY` | Variable | Server SSH host public key (for host key pinning) |
 | `DEPLOY_SSH_KEY` | Secret | SSH private key for the deploy user |
 | `CI_REGISTRY_TOKEN` | Secret | Gitea token for Docker registry login |
+
+After reprovisioning hantim (new host key), update `DEPLOY_HOST_KEY`:
+
+```bash
+ssh-keyscan -t ed25519 hantim.net 2>/dev/null
+```