diff --git a/scripts/secrets/push-host-keys.sh b/scripts/secrets/push-host-keys.sh
index 38a4cde..5ceb763 100755
--- a/scripts/secrets/push-host-keys.sh
+++ b/scripts/secrets/push-host-keys.sh
@@ -66,8 +66,15 @@ prompt_sudo_password() {
     sudo_password="$SUDO_PASS"
     return
   fi
-  read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password < /dev/tty
-  echo >&2
+  # Prefer /dev/tty so the prompt works even when stdout/stdin are redirected;
+  # fall back to plain stdin for environments where /dev/tty isn't available.
+  if [[ -r /dev/tty && -w /dev/tty ]]; then
+    read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password < /dev/tty
+    echo >&2
+  else
+    read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password
+    echo >&2
+  fi
 }
 
 locally_managed_hosts() {