diff --git a/machines.nix b/machines.nix
index 69d0d14..d089291 100644
--- a/machines.nix
+++ b/machines.nix
@@ -1,4 +1,4 @@
-{
+{config, ...}: {
   lenovo = {
     hostname = "lenovo";
     system = "x86_64-linux";
@@ -27,8 +27,10 @@
       ./modules/nixos/networking/networks/109-199-104-83.nix
 
       # ssh through port 5522 among other things
+      # andromeda@lenovo is the only user allowed access
       ./modules/nixos/networking/hard-ssh.nix
       ./modules/nixos/networking/ssh-as-root.nix
+      {users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];}
 
       # boilerplate settings
       ./modules/nixos/common.nix