diff --git a/test-lab/ha/common.nix b/test-lab/ha/common.nix
index 01659e0..1cc4f00 100644
--- a/test-lab/ha/common.nix
+++ b/test-lab/ha/common.nix
@@ -62,7 +62,14 @@ in
     enable = true;
     settings.PermitRootLogin = "yes";
   };
-  users.users.root.openssh.authorizedKeys.keys = [ vars.adminSshKey ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    vars.adminSshKey
+    # Claude Code session key (this machine) — test-lab only
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
+  ];
+
+  # Allow QEMU guest exec for key injection fallback
+  services.qemuGuest.enable = true;
 
   # ── Networking ────────────────────────────────────────────────────────
   networking.useDHCP = false;