diff --git a/ssh/auth.go b/ssh/auth.go
index 34c8c6e..5207907 100644
--- a/ssh/auth.go
+++ b/ssh/auth.go
@@ -1,6 +1,7 @@
 package ssh
 
 import (
+	"github.com/google/uuid"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -11,7 +12,8 @@ const isAnonymousKey = "is_anonymous"
 func AuthenticatePublicKey(store Store, conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
 	fingerprint := ssh.FingerprintSHA256(key)
 	user, err := store.UserByFingerprint(fingerprint)
-	if err != nil {
+
+	if err != nil || user.ID == uuid.Nil {
 		return &ssh.Permissions{
 			Extensions: map[string]string{
 				isAnonymousKey: "true",