diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml
index e4280a0..14d3cd3 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/build-deploy.yml
@@ -23,20 +23,18 @@ jobs:
       - name: Set up SSH key and pinned host keys
         # Same key used both as the theme repo's deploy key (Gitea) and for
         # the webserver login (below) — one secret, two authorized_keys entries.
-        # Host keys are pinned via vars (each a full known_hosts-format line,
-        # e.g. from the server's own /etc/ssh/ssh_host_rsa_key.pub) rather
-        # than fetched via ssh-keyscan — no extra network calls, no TOFU, and
-        # no risk of tripping aquaria's connection-rate limiting.
+        # Host keys are pinned via a var (known_hosts-format lines, pasted
+        # directly from a known_hosts file that already trusts both hosts)
+        # rather than fetched via ssh-keyscan — no extra network calls, no
+        # TOFU, and no risk of tripping aquaria's connection-rate limiting.
         env:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-          GITEA_HOST_KEY: ${{ vars.GITEA_HOST_KEY }}
-          DEPLOY_HOST_KEY: ${{ vars.DEPLOY_HOST_KEY }}
+          KNOWN_HOSTS: ${{ vars.KNOWN_HOSTS }}
         run: |
           mkdir -p ~/.ssh
           printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          printf '%s\n' "$GITEA_HOST_KEY" >> ~/.ssh/known_hosts
-          printf '%s\n' "$DEPLOY_HOST_KEY" >> ~/.ssh/known_hosts
+          printf '%s\n' "$KNOWN_HOSTS" >> ~/.ssh/known_hosts
 
       - name: Fetch theme submodule
         run: |