diff --git a/profiles/core/default.nix b/profiles/core/default.nix
index 41b5136e..9e98ba6b 100644
--- a/profiles/core/default.nix
+++ b/profiles/core/default.nix
@@ -143,6 +143,12 @@ in
     '';
   };
 
+  # For rage encryption, all hosts need a ssh key pair
+  services.openssh = {
+    enable = true;
+    openFirewall = lib.mkDefault false;
+  };
+
   services.earlyoom.enable = true;
 
 }