diff --git a/common/ssh.nix b/common/ssh.nix
index 636ec6f..d088f46 100644
--- a/common/ssh.nix
+++ b/common/ssh.nix
@@ -15,7 +15,7 @@
       }
     ];
     settings = {
-      PermitRootLogin = "no";
+      PermitRootLogin = "forced-commands-only";
       PasswordAuthentication = false;
     };
   };