diff --git a/README.md b/README.md
index 5411dab8..07810461 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,10 @@ nix.settings.experimental-features = [ "nix-command" "flakes" ];
 is deprecated. Everything should be done through sops.
 If you don't have secrets access ask sandro or astro to get onboarded.
 
+### SSH access
+
+If people should get root access to *all* machines, their keys should be added to ``ssh-public-keys.nix``.
+
 ## Deployment
 
 ### Deploy to a remote NixOS system