diff --git a/kubernetes/justfile b/kubernetes/justfile
index 65aa836..e23468b 100755
--- a/kubernetes/justfile
+++ b/kubernetes/justfile
@@ -57,8 +57,21 @@ ansible:
 verify:
     cd {{ANSIBLE}} && ansible-playbook verify.yml
 
-# Full lifecycle: build → deploy → wait → install → verify
-up: build deploy wait-ssh ansible
+# Generate SSH keypair if missing (writes ssh-key + ssh-public-key)
+genkey:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [[ -f {{SSH_KEY}} ]]; then
+        echo "SSH key already exists at {{SSH_KEY}}; skipping."
+    else
+        ssh-keygen -t ed25519 -N "" -C k8s-cluster -f {{SSH_KEY}}
+        mv {{SSH_KEY}}.pub {{KUBE_DIR}}/ssh-public-key
+        chmod 600 {{SSH_KEY}}
+        echo "Generated new SSH keypair; ssh-public-key updated."
+    fi
+
+# Full lifecycle: genkey → build → deploy → wait → install → verify
+up: genkey build deploy wait-ssh ansible
 
 # Run all linters
 lint: