diff --git a/bastion/tests/integration/data-disks.test.ts b/bastion/tests/integration/data-disks.test.ts
index b4b3f46..a018452 100644
--- a/bastion/tests/integration/data-disks.test.ts
+++ b/bastion/tests/integration/data-disks.test.ts
@@ -41,6 +41,18 @@ const RN = { serial: "RNDRILL7FD4070C", sizeGb: 20 };
 const PRESERVED = ["/home", "/srv", "/var/lib/longhorn", "/var/lib/rancher"];
 
 function findSshKey(): { pubKey: string; keyPath: string } {
+  // A passphrase-protected default key fails SILENTLY here: BatchMode ssh
+  // never offers it without an agent, the server logs only "Connection closed
+  // [preauth]", and the test reads as "installed machine never came up" when
+  // the machine was fine. LAB_TEST_SSH_KEY names a dedicated passphrase-less
+  // keypair and sidesteps the whole class.
+  const envKey = process.env["LAB_TEST_SSH_KEY"];
+  if (envKey) {
+    if (!existsSync(envKey) || !existsSync(`${envKey}.pub`)) {
+      throw new Error(`LAB_TEST_SSH_KEY=${envKey}: key or .pub missing`);
+    }
+    return { pubKey: readFileSync(`${envKey}.pub`, "utf-8").trim(), keyPath: envKey };
+  }
   const homes = [homedir()];
   const sudoUser = process.env["SUDO_USER"];
   if (sudoUser) homes.push(join("/home", sudoUser));