diff --git a/features.in/net-ssh/generate.mk b/features.in/net-ssh/generate.mk
index dec154bceca815c9de1f9387cbbbd2180062ac89..a2e7e4d95a3e66f0a164b3f60c5c682f83a07345 100644
--- a/features.in/net-ssh/generate.mk
+++ b/features.in/net-ssh/generate.mk
@@ -3,11 +3,11 @@ ifneq (,$(BUILDDIR))
 include $(BUILDDIR)/distcfg.mk
 
 # prepare the provided public SSH key to be carried over into the image
-all: SSH_DIR = $(BUILDDIR)/files/root/.ssh
+all: TMPDIR = $(BUILDDIR)/files/tmp
 all:
 	@if [ -s "$(SSH_KEY)" ]; then \
-		mkdir -pm0700 "$(SSH_DIR)"; \
-		install -pm0600 "$(SSH_KEY)" "$(SSH_DIR)/authorized_keys"; \
+		mkdir -p "$(TMPDIR)"; \
+		cp -v "$(SSH_KEY)" "$(TMPDIR)/root_ssh_key.pub"; \
 	fi
 
 endif
diff --git a/features.in/net-ssh/rootfs/image-scripts.d/51-root-ssh-key b/features.in/net-ssh/rootfs/image-scripts.d/51-root-ssh-key
new file mode 100755
index 0000000000000000000000000000000000000000..78ae93603808ea13cbde8af315871b6bee6751a2
--- /dev/null
+++ b/features.in/net-ssh/rootfs/image-scripts.d/51-root-ssh-key
@@ -0,0 +1,10 @@
+#!/bin/sh -efu
+
+TMPDIR=/tmp
+SSH_DIR=/root/.ssh
+
+if [ -e "$TMPDIR/root_ssh_key.pub" ]; then
+    mkdir -pm0700 "$SSH_DIR"
+    install -v -pm0600 "$TMPDIR/root_ssh_key.pub" "$SSH_DIR/authorized_keys"
+    rm -fv "$TMPDIR/root_ssh_key.pub"
+fi