diff --git a/infra/ansible/ansible.cfg b/infra/ansible/ansible.cfg
index 88c63cf..40ef556 100644
--- a/infra/ansible/ansible.cfg
+++ b/infra/ansible/ansible.cfg
@@ -61,4 +61,4 @@ retries = 3
 # traffic on the channel, and a silently dropped session is reported as a lost
 # host rather than a timeout. CountMax=6 gives up after three minutes, so a
 # genuinely dead connection is detected rather than hung on.
-ssh_args = -o ProxyCommand="cloudflared access ssh --hostname %h" -o ControlMaster=auto -o ControlPersist=300s -o Compression=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=6
+ssh_args = -o ProxyCommand="cloudflared access ssh --hostname %h" -o UserKnownHostsFile=known_hosts -o StrictHostKeyChecking=yes -o ControlMaster=auto -o ControlPersist=300s -o Compression=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=6
diff --git a/infra/ansible/known_hosts b/infra/ansible/known_hosts
new file mode 100644
index 0000000..4d007aa
--- /dev/null
+++ b/infra/ansible/known_hosts
@@ -0,0 +1,13 @@
+# Pinned SSH host keys for the nodes, reached at their Cloudflare hostnames.
+#
+# host_key_checking is on (ansible.cfg), and a fresh CI runner has no cached
+# keys, so the first CI deploy failed with "Host key verification failed".
+# Rather than turn checking off, the keys are pinned here and verified against
+# -- by CI and by every laptop, so verification no longer depends on whoever
+# happened to accept the key first.
+#
+# These are PUBLIC keys; committing them is safe and is the point. If a node is
+# reprovisioned its host key changes and the deploy fails loudly here until
+# this file is updated (fetch /etc/ssh/ssh_host_ed25519_key.pub from the node).
+ssh-staging.openbases.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcVIXO7Wzd+sIdcrIUTI0huAq3rRZirc7Umuztmyh8U
+ssh-exec-staging.openbases.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOWqJpxd18JhrYb6I/XlriG+M1OG2ZdkFFecZn84DSW5