diff --git a/config-drive/create_config_drive.sh b/config-drive/create_config_drive.sh
index d8ae698..b30e644 100644
--- a/config-drive/create_config_drive.sh
+++ b/config-drive/create_config_drive.sh
@@ -64,10 +64,6 @@
 config_image=$1
 shift
 
-if [ "$ssh_key" ] && [ -f "$ssh_key" ]; then
-        echo "adding pubkey from $ssh_key"
-        ssh_key_data=$(cat "$ssh_key")
-fi
 
 uuid=$(uuidgen)
 if ! [ "$hostname" ]; then
@@ -77,6 +73,11 @@
 trap 'rm -rf $config_dir' EXIT
 config_dir=$(mktemp -t -d configXXXXXX)
 
+if [ "$ssh_key" ] && [ -f "$ssh_key" ]; then
+        echo "adding pubkey from $ssh_key"
+        cp $ssh_key $config_dir/root_auth_keys
+fi
+
 if [ "$user_data" ] && [ -f "$user_data" ]; then
         echo "adding user data from $user_data"
         cp $user_data $config_dir/user-data
diff --git a/config-drive/master_config.sh b/config-drive/master_config.sh
index e472cc0..4ad5083 100644
--- a/config-drive/master_config.sh
+++ b/config-drive/master_config.sh
@@ -107,6 +107,18 @@
   fi
 }
 
+failsafe_ssh_key(){
+  if [ -f /mnt/root_auth_keys ]; then
+    echo "Installing failsafe public ssh key from /mnt/root_auth_keys to /root/.ssh/authorized_keys"
+    install -m 0700 -d /root/.ssh
+    cat /mnt/root_auth_keys >> /root/.ssh/authorized_keys
+    chmod 600 /root/.ssh/authorized_keys
+    sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/g' /etc/ssh/sshd_config
+    sed -i 's/^PasswordAuthentication.*/PasswordAuthentication yes/g' /etc/ssh/sshd_config
+    service ssh restart
+  fi
+}
+
 # Body ========================================================================
 process_network
 
@@ -118,6 +130,8 @@
 chmod -R 644 /srv/salt/reclass/classes/cluster/* || true
 chmod -R 644 /srv/salt/reclass/classes/system/*  || true
 
+failsafe_ssh_key
+
 echo "Configuring salt"
 envsubst < /root/minion.conf > /etc/salt/minion.d/minion.conf
 enable_services