diff --git a/nixos/hosts/nuc-server/default.nix b/nixos/hosts/nuc-server/default.nix
index ac8595ec..c449eac7 100644
--- a/nixos/hosts/nuc-server/default.nix
+++ b/nixos/hosts/nuc-server/default.nix
@@ -21,6 +21,8 @@
     ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKp2wgqFcr0LGaUXbom88/zK2631pysePUWIaCMljT0K root@backups-rpi4'' 
     ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcGPkzFaSGd1q/oy/uP5zEoOuPNr1h17ifu7oj4DaYO root@warsaw-ovh-01''
   ];
+  # Allow root login, but only with SSH keys
+  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "thunderbolt" "sd_mod" "uas" ];
   boot.initrd.kernelModules = [ "r8152" ];