diff --git a/bin/hey b/bin/hey
index 534f454d..bc69e713 100755
--- a/bin/hey
+++ b/bin/hey
@@ -149,8 +149,19 @@ function main {
     swap)        _swap $@                       ;;
     gc)          _gc "$@"                       ;;
     push)
-      rsync -avzh ./ "$1:$REMOTE/"
-      ssh -t -l "$USERNAME" "$1" "$REMOTE/bin/hey re" "${@[2,-1]}"
+      target=$1
+      cmd=${2:-test}
+      # build then ssh in to switch/boot/test so we don't require root ssh
+      # access on the remote.
+      echo "Enabling root ssh access on $target"
+      ssh -t "$target" "sudo mkdir -p /root/.ssh && sudo cp -f ~/.ssh/authorized_keys /root/.ssh/"
+      echo "Building $target ($cmd)"
+      HOSTNAME="${HOSTNAME:-$target}" _rebuild \
+        --build-host localhost \
+        --target-host "root@$target" \
+        $cmd
+      echo "Undoing root ssh access on $target"
+      ssh -t "root@$target" "rm -f /root/.ssh/authorized_keys"
       ;;
 
     gen|generations)
diff --git a/modules/services/ssh.nix b/modules/services/ssh.nix
index ea00a5b7..331c8f84 100644
--- a/modules/services/ssh.nix
+++ b/modules/services/ssh.nix
@@ -15,8 +15,9 @@ in {
       passwordAuthentication = false;
     };
 
-    user.openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8Tl2pj6CPBV3V72cohPhn+k0a/Na3cOrbmUtFC7rR7icWocSs1S1cSrP3sPLwUqRh3+zfIuLXTrTv3gj8Xvg8WELOspzsiYeAtbcHrnWnx/a7xzYvFyT9/8hkiGM/F6w7IuKEk+AZW34vARSgRPJ1FdH8NbPKJ8ay9zW9XB9YJGnbzIRmsVVpQ8l6Fh8ZqRjZfC1ea7hns8+HgjPrIHFb+S3qZZiwU4Gc8aWJy9ziwwkllEsSchv3aigYA3eOeW0FUQFiKsLGxbX2b2b3d6jFO4Pu+dMSen0h5IzBo0nh7UADSfJPdwbZaMuJzviKe2y6zg6jaM9XRIhLBT6bftDr henrik@lissner.net"
-    ];
+    user.openssh.authorizedKeys.keys =
+      if config.user.name == "hlissner"
+      then [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB71rSnjuC06Qq3NLXQJwSz7jazoB+umydddrxL6vg1a henrik@lissner.net" ]
+      else [];
   };
 }