diff --git a/workstation/configuration.org b/workstation/configuration.org
index de3657d..fcc6629 100644
--- a/workstation/configuration.org
+++ b/workstation/configuration.org
@@ -1053,6 +1053,7 @@ services = {
     startWhenNeeded = true;
     settings = {
       PasswordAuthentication = false;
+      PermitRootLogin = "prohibit-password";
       KbdInteractiveAuthentication = false;
     };
   };