diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index 9311807..71de1fe 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -223,6 +223,7 @@ jobs:
             kv/data/github-actions/xworkmate-bridge INTERNAL_SERVICE_TOKEN | INTERNAL_SERVICE_TOKEN ;
             kv/data/github-actions/xworkmate-bridge WORKSPACE_REPO_TOKEN | WORKSPACE_REPO_TOKEN ;
             kv/data/github-actions/xworkmate-bridge SINGLE_NODE_VPS_SSH_PRIVATE_KEY | SINGLE_NODE_VPS_SSH_PRIVATE_KEY ;
+            kv/data/github-actions/xworkmate-bridge SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64 | SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64 ;
             kv/data/github-actions/xworkmate-bridge SSH_KNOWN_HOSTS | SSH_KNOWN_HOSTS
 
       - name: Export deploy secrets
@@ -282,6 +283,7 @@ jobs:
         working-directory: xworkmate-bridge
         env:
           SINGLE_NODE_VPS_SSH_PRIVATE_KEY: ${{ steps.vault.outputs.SINGLE_NODE_VPS_SSH_PRIVATE_KEY }}
+          SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64: ${{ steps.vault.outputs.SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64 }}
           SSH_KNOWN_HOSTS: ${{ steps.vault.outputs.SSH_KNOWN_HOSTS }}
         run: bash ./scripts/github-actions/prepare-ssh.sh "${{ steps.deploy_meta.outputs.target_host }}" "${SSH_KNOWN_HOSTS}"
 
diff --git a/scripts/github-actions/prepare-ssh.sh b/scripts/github-actions/prepare-ssh.sh
index d48c9ec..12e44ed 100644
--- a/scripts/github-actions/prepare-ssh.sh
+++ b/scripts/github-actions/prepare-ssh.sh
@@ -4,12 +4,19 @@ set -euo pipefail
 TARGET_HOST="${1:?target host is required}"
 SSH_KNOWN_HOSTS_PAYLOAD="${2:-}"
 
-test -n "${SINGLE_NODE_VPS_SSH_PRIVATE_KEY:-}"
+if [[ -z "${SINGLE_NODE_VPS_SSH_PRIVATE_KEY:-}" && -z "${SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64:-}" ]]; then
+  echo "::error::SINGLE_NODE_VPS_SSH_PRIVATE_KEY or SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64 is required"
+  exit 1
+fi
 
 mkdir -p "${HOME}/.ssh"
 chmod 700 "${HOME}/.ssh"
 
-python3 .github/scripts/normalize-private-key.py normalize > "${HOME}/.ssh/id_rsa"
+if [[ -n "${SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64:-}" ]]; then
+  printf '%s' "${SINGLE_NODE_VPS_SSH_PRIVATE_KEY_B64}" | base64 -d > "${HOME}/.ssh/id_rsa"
+else
+  python3 .github/scripts/normalize-private-key.py normalize > "${HOME}/.ssh/id_rsa"
+fi
 chmod 600 "${HOME}/.ssh/id_rsa"
 ssh-keygen -y -f "${HOME}/.ssh/id_rsa" >/dev/null