diff --git a/.sops.yaml b/.sops.yaml
index e44df14..2b572a6 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -127,6 +127,16 @@ creation_rules:
   # scripts/secrets/sync-host-keys.sh yet, so whichever variant is actually
   # deployed next needs its recipient added here (and `sops updatekeys` rerun)
   # before it can decrypt this.
+  # Host keytab for tailscale-router FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  - path_regex: secrets/tailscale-router\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *lxc-tailscale-router
+          - *proxmox-tailscale-router
+          - *linode-tailscale-router
+
   - path_regex: secrets/gui\.yaml$
     key_groups:
       - age:
diff --git a/hosts/tailscale-router/host.nix b/hosts/tailscale-router/host.nix
index 72ece23..c95440c 100644
--- a/hosts/tailscale-router/host.nix
+++ b/hosts/tailscale-router/host.nix
@@ -8,13 +8,13 @@
     })
     (import ../../modules/ipa/client.nix {
       keytabSopsFile = ../../secrets/tailscale-router.keytab;
-      caCertFile     = ../../certs/ipa-ca.crt;
+      caCertFile = ../../certs/ipa-ca.crt;
     })
-
   ];
 
   networking = {
     hostName = "tailscale-router";
+    domain = vars.homeDomain;
     useDHCP = false;
     interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
       address = vars.tailscaleRouterIp;
diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index db83042..2278fe7 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -60,6 +60,19 @@ in
     cacheCredentials = true;
   };
 
+  # Fetch SSH public keys from IPA so users can log in with the key stored
+  # in their IPA profile rather than needing ~/.ssh/authorized_keys on every
+  # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
+  services.openssh.extraConfig = ''
+    AuthorizedKeysCommand ${pkgs.sssd}/bin/sss_ssh_authorizedkeys %u
+    AuthorizedKeysCommandUser nobody
+  '';
+
+  # Create the home directory on first login if it doesn't exist yet.
+  # IPA users have no pre-created home on the host; without this sshd
+  # opens a session to a non-existent directory and resets the connection.
+  security.pam.services.sshd.makeHomeDir = true;
+
   # Host keytab: pre-provisioned on the IPA server, sops-encrypted binary.
   # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
   # to IPA without running ipa-client-install.