diff --git a/infra/ansible/ansible.cfg b/infra/ansible/ansible.cfg
index 60fc2a3..3667681 100644
--- a/infra/ansible/ansible.cfg
+++ b/infra/ansible/ansible.cfg
@@ -3,6 +3,10 @@ inventory = inventory/hosts.ini
 roles_path = roles
 host_key_checking = False
 retry_files_enabled = False
+# SSH key the k3s nodes authorize for the `k3s` user (see inventory ansible_user).
+# Set here so node config plays (e.g. the rolling k3s config.yaml + Restart handler) connect
+# without a per-run --private-key. Path is on the operator workstation / dev container ~/.ssh.
+private_key_file = ~/.ssh/home_network
 # ansible-core 2.20 removed community.general.yaml; use the builtin default with YAML result format.
 stdout_callback = default
 result_format = yaml