diff --git a/ops/nixos/whitby/default.nix b/ops/nixos/whitby/default.nix
index 093c1ee63..4296c3f32 100644
--- a/ops/nixos/whitby/default.nix
+++ b/ops/nixos/whitby/default.nix
@@ -170,7 +170,11 @@ in lib.fix(self: {
   };
 
   programs.mtr.enable = true;
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    passwordAuthentication = false;
+    challengeResponseAuthentication = false;
+  };
 
   # Run a handful of Buildkite agents to support parallel builds.
   services.buildkite-agents = listToAttrs (map (n: rec {