diff --git a/Partnership/onboard_cancel.sh b/Partnership/onboard_cancel.sh
index ff855b1..1798489 100755
--- a/Partnership/onboard_cancel.sh
+++ b/Partnership/onboard_cancel.sh
@@ -192,6 +192,7 @@ if [[ "$DIRECTION" == "h1" || "$DIRECTION" == "both" ]]; then
             _cancel_out=$(timeout "$SSH_TIMEOUT" ssh -i "$SSH_KEY" \
                 -o ConnectTimeout="$SSH_TIMEOUT" -o BatchMode=yes root@"$MIRROR_IP" \
                 "sed -i \"\\|${KEY_BLOB}|d\" /root/.ssh/authorized_keys || { echo sed-failed; exit 1; }
+                 chmod 600 /root/.ssh/authorized_keys 2>/dev/null
                  sed -i \"/^${MIRROR_ID}_PHASE/d; /^${MIRROR_ID}_KEY_READY/d\" $(platform_setup_db_path) 2>/dev/null
                  grep -qF '${KEY_BLOB}' /root/.ssh/authorized_keys 2>/dev/null && echo still-present || echo ok" 2>/dev/null)
             case "$_cancel_out" in
@@ -249,7 +250,9 @@ if [[ "$DIRECTION" == "h2" || "$DIRECTION" == "both" ]]; then
         warn "DRY RUN — would remove $MIRROR_SHORT key from $AUTH_KEYS"
         H2_DONE=true
     else
-        sed -i "/${MIRROR_SHORT}/Id" "$AUTH_KEYS" && {
+        # chmod after: sed -i rewrites via a temp file, which lands under the umask and can
+        # leave the file 0666. sshd StrictModes then silently refuses every key in it.
+        sed -i "/${MIRROR_SHORT}/Id" "$AUTH_KEYS" && chmod 600 "$AUTH_KEYS" && {
             echo "$MIRROR key removed from HOST1 authorized_keys ✅"
             H2_DONE=true
         } || warn "Failed to remove $MIRROR key from HOST1 authorized_keys"
diff --git a/Partnership/partnership_manager.sh b/Partnership/partnership_manager.sh
index aa859e4..de9070b 100755
--- a/Partnership/partnership_manager.sh
+++ b/Partnership/partnership_manager.sh
@@ -467,6 +467,7 @@ do_ssh_key_revocation() {
                 "grep -v '${our_comment}' /root/.ssh/authorized_keys \
                  > /root/.ssh/authorized_keys.tmp 2>/dev/null \
                  && mv /root/.ssh/authorized_keys.tmp /root/.ssh/authorized_keys \
+                 && chmod 600 /root/.ssh/authorized_keys \
                  && echo removed" 2>/dev/null | grep -q removed; then
                 echo "Our pubkey revoked from $REMOTE_SERVER_NAME ✅"
                 SSH_REVOKE_REMOTE_OK=true
@@ -490,9 +491,16 @@ do_ssh_key_revocation() {
         SSH_REVOKE_LOCAL_OK=true
     elif [[ -f /root/.ssh/authorized_keys ]]; then
         if grep -q "@${REMOTE_SERVER_NAME}" /root/.ssh/authorized_keys 2>/dev/null; then
+            # chmod after the mv, every time. `>` creates the temp file under the shell's umask
+            # and `mv` keeps the NEW file's mode, so this rewrite left authorized_keys 0666 on a
+            # filesystem that permits it. sshd's StrictModes then refuses every key in it without
+            # saying so to the client — the key is present, byte-correct, and inert, and the next
+            # onboard's SSH step fails with nothing in any Varaverk log to explain it. Only
+            # /var/log/syslog knows: "Authentication refused: bad ownership or modes".
             if grep -v "@${REMOTE_SERVER_NAME}" /root/.ssh/authorized_keys \
                 > /root/.ssh/authorized_keys.tmp 2>/dev/null && \
-                mv /root/.ssh/authorized_keys.tmp /root/.ssh/authorized_keys; then
+                mv /root/.ssh/authorized_keys.tmp /root/.ssh/authorized_keys && \
+                chmod 600 /root/.ssh/authorized_keys; then
                 echo "$REMOTE_SERVER_NAME pubkey revoked locally ✅"
                 SSH_REVOKE_LOCAL_OK=true
             else