diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml
index cf6f0f5..9457546 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/build-deploy.yml
@@ -46,8 +46,12 @@ jobs:
           mkdir -p ~/.ssh
           printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -4 -v -H git.haemka.in >> ~/.ssh/known_hosts
-          ssh-keyscan -4 -v -H -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" >> ~/.ssh/known_hosts
+          # -t rsa: both hosts confirmed to offer an RSA host key. Restricting
+          # to one type means one connection per host instead of ~4 fired at
+          # once (one per probed key type), which aquaria's connection-rate
+          # limiting was intermittently dropping past the first.
+          ssh-keyscan -4 -t rsa -H git.haemka.in >> ~/.ssh/known_hosts
+          ssh-keyscan -4 -t rsa -H -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" >> ~/.ssh/known_hosts
 
       - name: Fetch theme submodule
         run: |