diff --git a/Dockerfile b/Dockerfile
index f705397..3204313 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,10 +26,12 @@ arg GID=1000
 copy rootfs .
 run chmod 755 /etc
 run chmod -R 755 /etc/s6-overlay
-run apk add --no-cache shadow s6-overlay execline openssl openssh git curl bash
+run apk add --no-cache shadow s6-overlay execline openssh git curl bash
 run groupadd -g $GID -f git
 run useradd -u $UID -g $GID -d /home/git git
-run openssl rand -hex 16 | passwd --stdin git
+# setting the password to `*` disables password-based access without locking the
+# account out of ssh: <https://unix.stackexchange.com/a/193131>
+run usermod --password '*' git
 run mkdir -p /home/git/repositories && chown -R git:git /home/git
 copy --from=builder /usr/bin/knot /usr/bin
 run mkdir /app && chown -R git:git /app