diff --git a/playbook/blancco-init.sh b/playbook/blancco-init.sh
index 662986f..6fe2e35 100644
--- a/playbook/blancco-init.sh
+++ b/playbook/blancco-init.sh
@@ -271,6 +271,22 @@ XEOF
 chmod +x /run/newroot/etc/X11/xinit/xinitrc.d/00-no-screen-blank.sh
 
 mkdir -p /run/newroot/proc /run/newroot/sys /run/newroot/dev /run/newroot/run /run/newroot/tmp
+# Debug boots only: Blancco's own debug mode (/etc/debug.environment makes
+# isDebugMode true, so 2_sshd starts sshd) plus an SSH key for root.
+# Root is locked and sshd is key-only, so without the key there is no way
+# in. The key is served from the PXE server and never baked in here.
+if [ -n "$DEBUG" ]; then
+    touch /run/newroot/etc/debug.environment
+    mkdir -p /run/newroot/root/.ssh
+    if wget -q -T 10 -O /run/newroot/root/.ssh/authorized_keys "http://$SERVER/blancco/debug_authorized_keys"; then
+        chmod 700 /run/newroot/root/.ssh
+        chmod 600 /run/newroot/root/.ssh/authorized_keys
+        echo "  debug: sshd on, root key installed"
+    else
+        echo "  debug: no debug_authorized_keys on server, SSH stays closed"
+    fi
+fi
+
 mount --move /proc /run/newroot/proc
 mount --move /sys /run/newroot/sys
 mount --move /dev /run/newroot/dev