diff --git a/nix/modules/knot.nix b/nix/modules/knot.nix
--- a/nix/modules/knot.nix
+++ b/nix/modules/knot.nix
@@ -195,6 +195,8 @@ extraConfig = ''
           Match User ${cfg.gitUser}
               AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper
               AuthorizedKeysCommandUser nobody
+              ChallengeResponseAuthentication no
+              PasswordAuthentication no
         '';
       };