diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 2cc63ee..8ac3d2a 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -12,7 +12,10 @@ set -euo pipefail
 ALIAS="thuisbatterij"
 APP_DIR="/opt/thuisbatterij"
 
-echo "→ checking SSH"
+echo "→ checking SSH (auto-refreshing host key if h4a recreated the VM)"
+HOST=$(awk -v a="${ALIAS}" '$1=="Host"{h=$2} h==a&&$1=="HostName"{print $2; exit}' "${HOME}/.ssh/config")
+ssh-keygen -R "${HOST}" >/dev/null 2>&1 || true
+ssh-keyscan -t ed25519,rsa "${HOST}" 2>/dev/null >> "${HOME}/.ssh/known_hosts"
 ssh -o BatchMode=yes -o ConnectTimeout=8 ${ALIAS} 'true'
 
 echo "→ rsyncing source to ${ALIAS}:${APP_DIR}"