diff --git a/os/mkosi/mkosi.postinst b/os/mkosi/mkosi.postinst
index a23f4003a..2b767debd 100755
--- a/os/mkosi/mkosi.postinst
+++ b/os/mkosi/mkosi.postinst
@@ -11,3 +11,7 @@ rm -f "$B/etc/machine-id" "$B/var/lib/dbus/machine-id"
 # measured image to keep clean builds reproducible.
 rm -f "$B/var/log/alternatives.log" "$B/var/log/dpkg.log"
 rm -rf "$B/var/log/apt"
+
+# Host keys must be unique per booted development VM, never shared by all
+# guests built from one image. OpenSSH generates them on first boot.
+rm -f "$B"/etc/ssh/ssh_host_*_key "$B"/etc/ssh/ssh_host_*_key.pub
diff --git a/os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf b/os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf
new file mode 100644
index 000000000..e7adff045
--- /dev/null
+++ b/os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: Apache-2.0
+[Unit]
+Requires=dstack-prepare.service
+After=dstack-prepare.service
+
+[Service]
+# Debian validates host keys before starting sshd. Generate the development
+# VM's volatile keys only after dstack-prepare has mounted the writable /etc
+# overlay, then run the package's original validation step.
+ExecStartPre=
+ExecStartPre=/usr/bin/ssh-keygen -A
+ExecStartPre=/usr/sbin/sshd -t