diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index 2278fe7..3e543f2 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -63,8 +63,19 @@ in
   # Fetch SSH public keys from IPA so users can log in with the key stored
   # in their IPA profile rather than needing ~/.ssh/authorized_keys on every
   # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
+  #
+  # /nix/store is 1775 (group-writable by nixbld). OpenSSH 10.0+ rejects
+  # AuthorizedKeysCommand binaries whose path contains any group-writable
+  # component, silently skipping the command. Copy to /usr/local/bin (all
+  # components root-owned, 755) so the path passes sshd's safety check.
+  systemd.tmpfiles.rules = [
+    "d /usr/local 0755 root root - -"
+    "d /usr/local/bin 0755 root root - -"
+    "C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys"
+  ];
+
   services.openssh.extraConfig = ''
-    AuthorizedKeysCommand ${pkgs.sssd}/bin/sss_ssh_authorizedkeys %u
+    AuthorizedKeysCommand /usr/local/bin/sss_ssh_authorizedkeys %u
     AuthorizedKeysCommandUser nobody
   '';