diff --git a/nix/modules/knot.nix b/nix/modules/knot.nix
index 43fe600a..06a6caba 100644
--- a/nix/modules/knot.nix
+++ b/nix/modules/knot.nix
@@ -195,6 +195,8 @@ in
           Match User ${cfg.gitUser}
               AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper
               AuthorizedKeysCommandUser nobody
+              ChallengeResponseAuthentication no
+              PasswordAuthentication no
         '';
       };