diff --git a/hosts/AZ-CLD-1/services/var-backup-sync.nix b/hosts/AZ-CLD-1/services/var-backup-sync.nix
index 13e2a1a..d0204da 100644
--- a/hosts/AZ-CLD-1/services/var-backup-sync.nix
+++ b/hosts/AZ-CLD-1/services/var-backup-sync.nix
@@ -48,6 +48,11 @@ in {
 
       lock_file="/run/${serviceName}/${serviceName}.lock"
 
+      if ! ssh-keygen -y -f ${sshKey} >/dev/null; then
+        echo "Invalid SSH private key secret at ${sshKey}" >&2
+        exit 1
+      fi
+
       flock -n "$lock_file" \
         rsync \
           -aH \
diff --git a/hosts/AZ-PRM-1/services/backup-ingest.nix b/hosts/AZ-PRM-1/services/backup-ingest.nix
index 0f1d387..b16f4aa 100644
--- a/hosts/AZ-PRM-1/services/backup-ingest.nix
+++ b/hosts/AZ-PRM-1/services/backup-ingest.nix
@@ -13,7 +13,7 @@ in {
     createHome = false;
     shell = pkgs.bashInteractive;
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6FhMvJqh7m+AfC5yeHUIxhEvalSoA5OzqtDVstuAX1 cld-var-backup-sync@AZ-CLD-1-to-AZ-PRM-1"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBAbgaMFD8U+NrhA4P7BzVOsAbuu82ebkAOfQA09u12v cld-var-backup-sync@AZ-CLD-1-to-AZ-PRM-1"
     ];
   };
 
diff --git a/secrets/cld-var-backup-sync-ssh-key.age b/secrets/cld-var-backup-sync-ssh-key.age
index 800bddc..20b5dc9 100644
Binary files a/secrets/cld-var-backup-sync-ssh-key.age and b/secrets/cld-var-backup-sync-ssh-key.age differ