diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index 1aa8deb..2278fe7 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -68,6 +68,11 @@ in
     AuthorizedKeysCommandUser nobody
   '';
 
+  # Create the home directory on first login if it doesn't exist yet.
+  # IPA users have no pre-created home on the host; without this sshd
+  # opens a session to a non-existent directory and resets the connection.
+  security.pam.services.sshd.makeHomeDir = true;
+
   # Host keytab: pre-provisioned on the IPA server, sops-encrypted binary.
   # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
   # to IPA without running ipa-client-install.