diff --git a/ct-inventory.md b/ct-inventory.md
index a94dbeb..fd6142c 100644
--- a/ct-inventory.md
+++ b/ct-inventory.md
@@ -20,4 +20,28 @@ UNAS NFS = `192.168.1.31:/var/nfs/shared/storage` over NFSv3. CT 105 (Nextcloud)
 
 CT 112 ("secrets") — Infisical deployment planned; see `services/secrets-manager.md`.
 
+## SSH access
+
+The Proxmox host (`nuc`, `192.168.1.20`) has root SSH access to all LXC containers via key auth. To grant your own key access to every running container in one step, run on the host:
+
+```bash
+deploy-ssh-key "ssh-ed25519 AAAA... you@yourmachine"
+# or pipe it:
+ssh nuc 'cat' < ~/.ssh/id_ed25519.pub | deploy-ssh-key
+```
+
+Script is at `/usr/local/bin/deploy-ssh-key`. It iterates `pct list`, skips stopped CTs, and appends the key to `/root/.ssh/authorized_keys` idempotently (no duplicates).
+
+**VM 100 (HAOS, `192.168.1.60`)** cannot be reached via `pct exec`. Install manually in the HA terminal:
+
+```bash
+echo "ssh-ed25519 AAAA... you@yourmachine" >> ~/.ssh/authorized_keys
+```
+
+**Host key** (`root@nuc`, already deployed to all CTs 2026-05-21):
+
+```
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCuVqBW3VXg... root@nuc
+```
+
 CT 113 ("db") is mentioned in memory notes (`postgres-consolidation`) as a future consolidation target. Not yet planned in any source-of-truth doc.