diff --git a/playbooks/bootstrap.yml b/playbooks/bootstrap.yml
index bdb6f21..f235963 100644
--- a/playbooks/bootstrap.yml
+++ b/playbooks/bootstrap.yml
@@ -106,9 +106,11 @@
     managed_user: ansible
     new_hostname: "{{ new_hostname | default('racknerd1') }}"
     ansible_user: "{{ connect_user | default('root') }}"
-    ansible_password: "{{ hostvars['localhost'].pc_root_pass }}"
-    ansible_become_password: "{{ hostvars['localhost'].pc_root_pass }}"
-    ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new"
+    # Connect as root using the deploy SSH key (written to the runner temp file in precheck).
+    # racknerd-class hosts use PermitRootLogin without-password, so password auth won't work;
+    # the deploy key must already be in root's authorized_keys (one-time seeding).
+    ansible_ssh_private_key_file: "/tmp/bootstrap_deploy_key"
+    ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes"
     managed_ssh_pubkey: "{{ hostvars['localhost'].pc_ssh_pubkey }}"
     managed_user_password: "{{ hostvars['localhost'].pc_user_pass }}"
     cleanup_paths: []