diff --git a/scripts/secrets/push-host-keys.sh b/scripts/secrets/push-host-keys.sh
index a74d73f..09b3a87 100755
--- a/scripts/secrets/push-host-keys.sh
+++ b/scripts/secrets/push-host-keys.sh
@@ -145,15 +145,15 @@ _do_push() {
   scp -o StrictHostKeyChecking=no \
     "$pubfile" "${SSH_USER}@${hostname}:/tmp/push_ed25519_key.pub"
 
-  # Install with correct permissions in one interactive sudo session
+  # Install with correct permissions via sudo. Commands are passed as an
+  # argument string (not heredoc) so stdin stays free and -t can allocate
+  # a PTY for the sudo password prompt.
   echo "  (sudo password may be required)"
   ssh -t -o StrictHostKeyChecking=no "${SSH_USER}@${hostname}" \
-    "sudo bash -s" <<'REMOTE'
-install -m 0600 /tmp/push_ed25519_key     /etc/ssh/ssh_host_ed25519_key
-install -m 0644 /tmp/push_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub
-rm -f /tmp/push_ed25519_key /tmp/push_ed25519_key.pub
-echo "  [ok] host key installed"
-REMOTE
+    "sudo install -m 0600 /tmp/push_ed25519_key     /etc/ssh/ssh_host_ed25519_key &&
+     sudo install -m 0644 /tmp/push_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub &&
+     sudo rm -f /tmp/push_ed25519_key /tmp/push_ed25519_key.pub &&
+     echo '  [ok] host key installed'"
 
   # Drop the stale known_hosts entry for this host (public key just changed)
   ssh-keygen -R "$hostname" 2>/dev/null || true