diff --git a/deploy/ansible/roles/base/handlers/main.yml b/deploy/ansible/roles/base/handlers/main.yml
index d5d441f..e7ef44a 100644
--- a/deploy/ansible/roles/base/handlers/main.yml
+++ b/deploy/ansible/roles/base/handlers/main.yml
@@ -7,3 +7,8 @@
 - name: Reload sysctl
   ansible.builtin.command: sysctl --system
   changed_when: true
+
+- name: Reload ssh
+  ansible.builtin.systemd:
+    name: ssh
+    state: reloaded
diff --git a/deploy/ansible/roles/base/tasks/main.yml b/deploy/ansible/roles/base/tasks/main.yml
index 7ddadea..30f9117 100644
--- a/deploy/ansible/roles/base/tasks/main.yml
+++ b/deploy/ansible/roles/base/tasks/main.yml
@@ -68,6 +68,25 @@
     enabled: true
     state: started
 
+# --- SSH Hardening ---
+
+# Key-only logins. Named 10-* so sshd reads it before cloud-init's
+# 50-cloud-init.conf, which turns password logins on; sshd keeps the first
+# value it sees for each option. The Vultr web console still accepts the
+# root password if the key is ever lost.
+- name: Disable SSH password authentication
+  ansible.builtin.copy:
+    dest: /etc/ssh/sshd_config.d/10-rustyip.conf
+    content: |
+      PasswordAuthentication no
+      KbdInteractiveAuthentication no
+      PermitRootLogin prohibit-password
+    owner: root
+    group: root
+    mode: "0644"
+    validate: /usr/sbin/sshd -t -f %s
+  notify: Reload ssh
+
 # --- Kernel Tuning ---
 
 - name: Deploy sysctl tuning configuration
diff --git a/deploy/ansible/roles/base/templates/fail2ban-sshd.conf.j2 b/deploy/ansible/roles/base/templates/fail2ban-sshd.conf.j2
index bfbedda..bbbf0f7 100644
--- a/deploy/ansible/roles/base/templates/fail2ban-sshd.conf.j2
+++ b/deploy/ansible/roles/base/templates/fail2ban-sshd.conf.j2
@@ -10,5 +10,5 @@ bantime   = 3600
 banaction         = iptables-multiport
 banaction_allports = iptables-allports
 
-logpath   = /var/log/auth.log
-backend   = auto
+# Debian 13 logs to the journal only (no rsyslog, so no /var/log/auth.log)
+backend   = systemd
diff --git a/deploy/ansible/roles/base/templates/sysctl.conf.j2 b/deploy/ansible/roles/base/templates/sysctl.conf.j2
index 2c7194a..148fd01 100644
--- a/deploy/ansible/roles/base/templates/sysctl.conf.j2
+++ b/deploy/ansible/roles/base/templates/sysctl.conf.j2
@@ -48,7 +48,9 @@ net.ipv4.tcp_max_tw_buckets = 65536
 
 # File descriptor limits (reduced for 1 GB RAM)
 fs.file-max = 65536
-fs.nr_open = 65536
+# fs.nr_open stays at the kernel default: systemd gives services a hard
+# NOFILE limit of 524288, and lowering nr_open below that makes every
+# service without its own LimitNOFILE fail to (re)start (205/LIMITS).
 
 # VM tuning (increased swappiness slightly for 1 GB RAM)
 vm.swappiness = 30