diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index c78b320..956841c 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -53,8 +53,21 @@ jobs:
           fi
 
           mkdir -p ~/.ssh
-          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_ed25519
+          umask 077
+          # Gitea often stores a multiline key as one line. Prefer a base64
+          # secret (one line). A raw key that still contains BEGIN is accepted too.
+          if printf '%s' "$PROD_SSH_KEY" | grep -q -- '-----BEGIN'; then
+            printf '%b\n' "$PROD_SSH_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
+          else
+            printf '%s' "$PROD_SSH_KEY" | tr -d '[:space:]' | base64 -d > ~/.ssh/id_ed25519
+          fi
           chmod 600 ~/.ssh/id_ed25519
+          if ! ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null; then
+            echo "ERROR: PROD_SSH_KEY is not a readable private key."
+            echo "On the runner, run: base64 -w0 ~/.ssh/mykopkb_prod"
+            echo "Put that single line in the PROD_SSH_KEY secret."
+            exit 1
+          fi
           ssh-keyscan -H "$PROD_HOST" >> ~/.ssh/known_hosts
 
           SSH=(ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes "${PROD_USER}@${PROD_HOST}")