diff --git a/seediso/debian13/build-seed.sh b/seediso/debian13/build-seed.sh
index 056757e..f54cb24 100755
--- a/seediso/debian13/build-seed.sh
+++ b/seediso/debian13/build-seed.sh
@@ -5,6 +5,33 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 output="${1:-${script_dir}/seed.iso}"
 files=(user-data meta-data)
 
+# Public key injected into user-data: $SSH_PUBKEY_FILE, else the first
+# ~/.ssh/id_*.pub, else the first key offered by ssh-agent.
+pubkey=""
+if [[ -n "${SSH_PUBKEY_FILE:-}" ]]; then
+  pubkey="$(head -n1 -- "${SSH_PUBKEY_FILE}")"
+else
+  for f in "${HOME}"/.ssh/id_ed25519.pub "${HOME}"/.ssh/id_*.pub; do
+    if [[ -f "$f" ]]; then pubkey="$(head -n1 -- "$f")"; break; fi
+  done
+  if [[ -z "$pubkey" ]] && command -v ssh-add >/dev/null 2>&1; then
+    pubkey="$(ssh-add -L 2>/dev/null | head -n1 || true)"
+  fi
+fi
+if [[ "$pubkey" != ssh-* && "$pubkey" != ecdsa-* && "$pubkey" != sk-* ]]; then
+  printf 'Error: no SSH public key found; set SSH_PUBKEY_FILE.\n' >&2
+  exit 1
+fi
+
+work="$(mktemp -d)"
+trap 'rm -rf -- "${work}"' EXIT
+template="$(<"${script_dir}/user-data")"
+printf '%s\n' "${template//@SSH_PUBKEY@/${pubkey}}" > "${work}/user-data"
+cp -- "${script_dir}/meta-data" "${work}/meta-data"
+if [[ -f "${script_dir}/network-config" ]]; then
+  cp -- "${script_dir}/network-config" "${work}/network-config"
+fi
+
 mkdir -p "$(dirname -- "$output")"
 
 if [[ -f "${script_dir}/network-config" ]]; then
@@ -14,19 +41,19 @@ fi
 if command -v cloud-localds >/dev/null 2>&1; then
   args=()
   if [[ -f "${script_dir}/network-config" ]]; then
-    args+=(--network-config="${script_dir}/network-config")
+    args+=(--network-config="${work}/network-config")
   fi
   cloud-localds "${args[@]}" "${output}" \
-    "${script_dir}/user-data" "${script_dir}/meta-data"
+    "${work}/user-data" "${work}/meta-data"
 elif command -v xorriso >/dev/null 2>&1; then
   xorriso -as mkisofs -quiet -volid cidata -joliet -rock \
-    -output "${output}" "${files[@]/#/${script_dir}/}"
+    -output "${output}" "${files[@]/#/${work}/}"
 elif command -v genisoimage >/dev/null 2>&1; then
   genisoimage -quiet -output "${output}" -volid cidata -joliet -rock \
-    "${files[@]/#/${script_dir}/}"
+    "${files[@]/#/${work}/}"
 elif command -v mkisofs >/dev/null 2>&1; then
   mkisofs -quiet -output "${output}" -volid cidata -joliet -rock \
-    "${files[@]/#/${script_dir}/}"
+    "${files[@]/#/${work}/}"
 else
   printf 'Error: install cloud-image-utils, xorriso, genisoimage, or mkisofs.\n' >&2
   exit 1
diff --git a/seediso/debian13/user-data b/seediso/debian13/user-data
index 5118852..641a125 100644
--- a/seediso/debian13/user-data
+++ b/seediso/debian13/user-data
@@ -11,7 +11,7 @@ users:
     sudo: "ALL=(ALL) NOPASSWD: ALL"
     lock_passwd: false
     ssh_authorized_keys:
-      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwsF2ZDSHDaXM9BdDq3Vxkp6T+DJEakKaVZQJUEHexS34mbrxYAxmGBUPCrddfE01dS31kGS4XHVBa+wGUYodY+nPwnrfD1Q4phKVSzXr65K1Y/sCcjSiANBPWpv2Xd7IMOfLlrdLtmf5QcKWroIqO2LaIDGECwzUUHrfprgeaF9N0FGcmrgbmm23JUk+f6guRQ4br88L4rWIWEBvL9bTdwErNkdfsYE2F/U8aIFpMcVy2eJIOgy8ZjZvkGdm4r730YkTDL1VmAjiHH3/m2R1EOvwLzFhyWKoa4ULk/IQW+8iNnG42QEcaWRM+hMwlVdnNhPJP6WzS+fAEbibD3zM0q2X/4ex+cXRNOCd2/0KhnD2+3p1BM5QeFTzDappkk8W2meQkDE3hvTjtIQCzygFO6LNWtEEa7BTvvlMqF3CZWh88J9XiP750SjESe3Ge5o9A0T2hcJa+KZ1LxVEmNt4nD6E/OD4EymoaLIJZ1fH5ksSFjHzJ+mJouSVjc/H/VSE= guofang@GUOFANG-OFFICE
+      - @SSH_PUBKEY@
     hashed_passwd: $6$0NtCERV3eO12t9oJ$nlFE2sSc66nFfuD5X0xMnOla1cuzOnHfeGNRY5X7dCDHg.WzWVmuRe7M17Puj44.eCWLnJAWt4WNjd9vP9X0D0
 
 chpasswd: