diff --git a/Dockerfile b/Dockerfile
index 7eee273..d7bbc42 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -153,6 +153,14 @@ RUN --mount=type=secret,id=ssh_key \
     ssh-keyscan git.kadil.dev >> ~/.ssh/known_hosts 2>/dev/null && \
     base64 -d /run/secrets/ssh_key > /tmp/ssh_key && \
     chmod 0600 /tmp/ssh_key && \
+    echo "=== Key identity diagnostic ===" && \
+    echo "Encoded secret size:  $(wc -c < /run/secrets/ssh_key) bytes" && \
+    echo "Decoded key size:     $(wc -c < /tmp/ssh_key) bytes" && \
+    echo "Fingerprint:" && \
+    ssh-keygen -lf /tmp/ssh_key 2>&1 || echo "  (failed to read key)" && \
+    echo "Derived public key (compare against Gitea's registered deploy key):" && \
+    ssh-keygen -y -f /tmp/ssh_key 2>&1 || echo "  (failed to derive public key)" && \
+    echo "=== end diagnostic ===" && \
     GIT_SSH_COMMAND="ssh -i /tmp/ssh_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/root/.ssh/known_hosts" \
     npm install && \
     rm -f /tmp/ssh_key