diff --git a/certs/gpgkey.pub b/certs/gpgkey.pub
new file mode 100644
index 0000000..9d65528
--- /dev/null
+++ b/certs/gpgkey.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPSvC13VgZuP40kWP82fnuthD6h2nXrm5uRgicZNSRTD cardno:24 409 474
diff --git a/certs/sakura.pub b/certs/sakura.pub
new file mode 100644
index 0000000..9fb52ae
--- /dev/null
+++ b/certs/sakura.pub
@@ -0,0 +1,6 @@
+(public-key
+ (ecc
+  (curve Ed25519)
+  (q #3E9614FD06AF20F9534DA0DE64FB9004878789744F26FFF2FF381E2EED1DEAC9#)
+  )
+ )
diff --git a/modules/freya/system.scm b/modules/freya/system.scm
index 094b2cf..5873d01 100644
--- a/modules/freya/system.scm
+++ b/modules/freya/system.scm
@@ -224,6 +224,9 @@
           ; openssh
           (service openssh-service-type
                    (openssh-configuration
+                     (authorized-keys
+                       `(("freya" ,(local-file "../../certs/gpgkey.pub"))
+                         ("root" ,(local-file "../../certs/gpgkey.pub"))))
                      (permit-root-login #t)
                      (allow-empty-passwords? #t)
                      (password-authentication? #f)
@@ -236,10 +239,12 @@
         (guix-configuration
           (inherit config)
           (substitute-urls
-            (append (list "https://substitutes.nonguix.org")
+            (append (list "https://substitutes.nonguix.org"
+                          "https://substitutes.freya.cat")
                     %default-substitute-urls))
           (authorized-keys
-            (append (list (local-file "../../certs/non-guix.pub"))
+            (append (list (local-file "../../certs/non-guix.pub")
+                          (local-file "../../certs/sakura.pub"))
                     %default-authorized-guix-keys)))))))
 
 (define-public %desktop-freya-services