diff --git a/.local/bin/dotfiles-install b/.local/bin/dotfiles-install
index ff57d1c..4eb1b13 100755
--- a/.local/bin/dotfiles-install
+++ b/.local/bin/dotfiles-install
@@ -100,6 +100,7 @@ _git config core.sparseCheckout true
     echo "/*"
     echo "!LICENSE.txt"
     echo "!README.md"
+    echo "!.ssh"
 } > "$DOTFILES_DIR/info/sparse-checkout"
 
 
diff --git a/.local/bin/ssh-setup b/.local/bin/ssh-setup
new file mode 100755
index 0000000..331615f
--- /dev/null
+++ b/.local/bin/ssh-setup
@@ -0,0 +1,83 @@
+#!/bin/sh
+
+# Set up `ssh` on a machine trusted with full access
+#
+# Install my public `ssh` keys into ~/.ssh/authorized_keys
+# taken from the local `dotfiles` repository
+# => Run `dotfiles pull` first to obtain the latest keys
+#
+# See: https://code.webartifex.de/alexander/dotfiles
+
+set -eu
+
+
+XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
+
+DOTFILES_DIR="${DOTFILES_DIR:-$XDG_DATA_HOME/dotfiles}"
+
+SSH_KEYS_FILE="$HOME/.ssh/authorized_keys"
+
+
+
+if [ ! -d "$DOTFILES_DIR" ]; then
+    echo "" >&2
+    echo "The dotfiles are not installed at: $DOTFILES_DIR" >&2
+    echo "=> Run dotfiles-install first" >&2
+    echo "" >&2
+
+    exit 1
+fi
+
+
+
+_git() {
+    git --git-dir="$DOTFILES_DIR" --work-tree="$HOME" "$@"
+}
+
+
+
+# Take my public `ssh` keys out of the local repository
+
+_keys_path=$(mktemp)
+trap 'rm -f "$_keys_path"' EXIT
+
+_git show "HEAD:.ssh/authorized_keys_webartifex" > "$_keys_path"
+
+
+
+# Show which keys are being authorized
+
+echo ""
+echo "Authorizing these keys:"
+echo ""
+if command -v ssh-keygen >/dev/null 2>&1; then
+    ssh-keygen -lf "$_keys_path"
+else
+    cat "$_keys_path"
+fi
+echo ""
+
+
+
+mkdir -p "$HOME/.ssh"
+
+
+
+# Append only keys that are not already authorized
+
+touch "$SSH_KEYS_FILE"
+
+while IFS= read -r _key; do
+    if ! grep -qxF "$_key" "$SSH_KEYS_FILE"; then
+        echo "$_key" >> "$SSH_KEYS_FILE"
+    fi
+done < "$_keys_path"
+
+
+
+chmod 700 "$HOME/.ssh"
+chmod 600 "$SSH_KEYS_FILE"
+
+
+
+echo "Installed the public keys into: $SSH_KEYS_FILE"
diff --git a/.ssh/README.md b/.ssh/README.md
new file mode 100644
index 0000000..b12ead2
--- /dev/null
+++ b/.ssh/README.md
@@ -0,0 +1,25 @@
+# `ssh`-related Files
+
+This folder contains
+    my [public SSH keys](./authorized_keys_webartifex),
+    to be enabled locally with [`ssh-setup`](../.local/bin/ssh-setup).
+
+
+## How the keys are managed
+
+The keys are tracked as `authorized_keys_webartifex`
+    and deliberately *not* as `~/.ssh/authorized_keys`:
+
+- The file is sparse-excluded and never checked out into `~/`
+- [`ssh-setup`](../.local/bin/ssh-setup) reads it
+  straight out of the local repository (i.e., `HEAD`)
+  and appends any missing keys to the untracked `~/.ssh/authorized_keys`
+- Keys added locally on a machine are never touched:
+  neither `dotfiles pull` nor a re-run of `ssh-setup` removes them
+- Because the two paths differ,
+  the machine-local file never shows up in `dotfiles status`
+  and cannot be overwritten by any `dotfiles` operation
+
+So, run `dotfiles pull` and then `ssh-setup`
+    to bring a trusted machine up to date with the latest keys,
+    giving me access to it.
diff --git a/.ssh/authorized_keys_webartifex b/.ssh/authorized_keys_webartifex
new file mode 100644
index 0000000..ea23d6b
--- /dev/null
+++ b/.ssh/authorized_keys_webartifex
@@ -0,0 +1,6 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOhhfx063dGoaE62cbdyGL3kp1AIovWFojQGNdqUpxr8 laplace
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRDaWrT2hH7BOV4Zv1ctVGqwfeqkssnHklRXBmng6Wr lazarus
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0GVKtgpgzpdf7E6e2vCytDSa2zPSgZ+8fAKCOotugH peter
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDq2JDk3pX79p7ampZhVQxIZg4qaUBkTPIQSbK0XeKoc wilddog
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGGNCrFt/gUbBHVqhthBuRmdDH6yS30+GGcCnARSzg+q wolfram
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKfaK5LUp7ghZLfl7urwQx+l+m/Vm7iksz8deGx4L5sD workstation2
diff --git a/README.md b/README.md
index 46e7a08..82b0f8c 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,18 @@ It targets [Debian](https://www.debian.org/) 13
     be it end-user software or common development utilities.
 
 
+## SSH Keys
+
+If I told you to go here and copy/paste my public `ssh` keys
+    to give me access to one of your servers,
+    find them
+    either [here](.ssh/authorized_keys_webartifex)
+    or [here](https://code.webartifex.de/alexander.keys).
+
+Read [this](https://code.webartifex.de/alexander/dotfiles/src/branch/main/.ssh#how-the-keys-are-managed)
+    for how the keys are managed.
+
+
 ## Installation
 
 Simply run: