diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index 97fc486..4f53aee 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -154,8 +154,11 @@ steps:
       ssh-keygen -y -P "" -f "$WORK/ssh/id" | ssh-keygen -lf - \
         || { echo "!! SHEAF_PAGES_SSH_KEY is not a valid openssh private key"; exit 1; }
       export GIT_SSH_COMMAND="ssh -i $WORK/ssh/id -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
-      ssh -o BatchMode=yes -T git@tangled.org 2>&1 | head -3 || true
+      # NOTE: no BatchMode on the probe — BatchMode disables host-key
+      # accept-new on first contact, and the microvm's known_hosts is empty.
+      # Let the clone establish the host key; probe auth second.
       git clone --depth 1 "$PAGES_REPO_SSH" "$DEPLOY"
+      ssh -T git@tangled.org 2>&1 | head -3 || true
 
       # copy from the sheaf checkout ($WORK still points into /workspace/repo)
       REL_DIR="$DEPLOY/sheaf/v${VERSION}"