diff --git a/.gitea/workflows/prod-deploy.yml b/.gitea/workflows/prod-deploy.yml
index 0f645ad..88de163 100644
--- a/.gitea/workflows/prod-deploy.yml
+++ b/.gitea/workflows/prod-deploy.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_TEST }}" > ~/.ssh/id_ed25519
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_PROD }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           printf '%s\n' "${{ secrets.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts
 
diff --git a/deploy/go-live.md b/deploy/go-live.md
index c3b628b..cb9ae0e 100644
--- a/deploy/go-live.md
+++ b/deploy/go-live.md
@@ -70,6 +70,9 @@ the DNS switch.
       provisioned (`deploy/backup-basel.md`), mirror live on Test AND on
       Prod since the v0.2.0 deploy (first run verified: all sets on
       BASEL, `status.json → mirror.lastRun = succeeded`).
-- [ ] Optional hygiene: a dedicated `DEPLOY_SSH_KEY_PROD` secret (the
-      workflows currently reuse the host-wide deploy key stored as
-      `DEPLOY_SSH_KEY_TEST`).
+- [x] Optional hygiene: a dedicated `DEPLOY_SSH_KEY_PROD` secret
+      (done 2026-07-14: third keypair `dorfteich-deploy-prod` in the
+      deploy user's authorized_keys, prod-deploy.yml switched off the
+      test key; every stage now deploys with its own revocable key —
+      note this separates rotation and audit, not privileges, since all
+      keys land in the same docker-group deploy user).