diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 9ae1e1e..a08e312 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -30,9 +30,10 @@ jobs:
           echo "$DEPLOY_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -p 2299 -H cryodev.xyz >> ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
 
       - name: Deploy with deploy-rs
-        run: nix run github:serokell/deploy-rs -- -s .#cryodev-main
+        run: NIX_SSHOPTS="-p 2299 -o StrictHostKeyChecking=accept-new" nix run github:serokell/deploy-rs -- -s .#cryodev-main
 
   build-pi-images:
     needs: flake-check
diff --git a/flake.nix b/flake.nix
index 1e759b1..d55310f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -123,6 +123,7 @@
         nodes = {
           cryodev-main = {
             hostname = constants.domain;
+            sshUser = "root";
             sshOpts = [
               "-p"
               "2299"