diff --git a/deploy/install.sh b/deploy/install.sh
index dcf7625..4418bb0 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -753,7 +753,7 @@ turn_shared_secret() {
 # контейнер LiveKit. Продление выполняет glchat-cert-refresh.timer.
 fetch_remote_turn_certificate() {
     [ -n "$TURN_CERT_REMOTE" ] || return 1
-    local ssh_opts=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -p "$TURN_CERT_SSH_PORT")
+    local ssh_opts=(-n -o BatchMode=yes -o StrictHostKeyChecking=accept-new -p "$TURN_CERT_SSH_PORT")
     [ -n "$TURN_CERT_SSH_KEY" ] && ssh_opts+=(-i "$TURN_CERT_SSH_KEY")
     command -v ssh >/dev/null 2>&1 || {
         warn "ssh не найден: не могу забрать сертификат с ${TURN_CERT_REMOTE}"
@@ -911,7 +911,7 @@ TMP_CRT="\$(mktemp)"; TMP_KEY="\$(mktemp)"
 trap 'rm -f "\$TMP_CRT" "\$TMP_KEY"' EXIT
 
 if [ -n "\$REMOTE" ]; then
-    ssh_opts="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -p \$SSH_PORT"
+    ssh_opts="-n -o BatchMode=yes -o StrictHostKeyChecking=accept-new -p \$SSH_PORT"
     [ -n "\$SSH_KEY" ] && ssh_opts="\$ssh_opts -i \$SSH_KEY"
     # shellcheck disable=SC2086
     ssh \$ssh_opts "\$REMOTE" "cat '\$REMOTE_CRT'" >"\$TMP_CRT" || exit 1