diff --git a/common/ssh.nix b/common/ssh.nix
index 29b1e6c..603f612 100644
--- a/common/ssh.nix
+++ b/common/ssh.nix
@@ -11,7 +11,7 @@
       }
     ];
     settings = {
-      PermitRootLogin = "without-password";
+      PermitRootLogin = "forced-commands-only";
       PasswordAuthentication = false;
     };
   };