diff --git a/config/hosts/plato.nix b/config/hosts/plato.nix
index d0dc36c..ba3709d 100644
--- a/config/hosts/plato.nix
+++ b/config/hosts/plato.nix
@@ -21,6 +21,11 @@ with lib; {
       Defaults lecture = never
     '';
 
+    systemd.tmpfiles.rules = [
+      "L /root/.ssh/id_rsa - - - - /state/root/ssh/id_rsa"
+      "L /root/.ssh/id_rsa.pub - - - - /state/root/ssh/id_rsa.pub"
+    ];
+
     services = {
       openssh = {
         hostKeys = [