diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 8f4d5ac..d92b0e7 100644
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -75,7 +75,13 @@ if [[ $SETUP_EXIT -ne 0 ]]; then
     exit $SETUP_EXIT
 fi
 
-# ── 4. Final status ──────────────────────────────────────────────────────────
+# ── 4. Strip key comments from authorized_keys ───────────────────────────────
+step "Stripping SSH key comments (OPSEC)..."
+ssh -o StrictHostKeyChecking=no "$TARGET" \
+    "awk '{print \$1, \$2}' /root/.ssh/authorized_keys > /tmp/.ak_clean && mv /tmp/.ak_clean /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys" 2>/dev/null || true
+info "Key comments stripped"
+
+# ── 5. Final status ──────────────────────────────────────────────────────────
 echo ""
 step "Deployment status"
 ssh -o StrictHostKeyChecking=no "$TARGET" \
diff --git a/scripts/preconfig_sd.sh b/scripts/preconfig_sd.sh
new file mode 100755
index 0000000..e33f77a
--- /dev/null
+++ b/scripts/preconfig_sd.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Pre-configure an Armbian SD card before first boot.
+# Handles: WiFi, root password, SSH keys (comments stripped), hostname, wizard bypass.
+#
+# Usage: sudo bash scripts/preconfig_sd.sh SSID PASSPHRASE [MOUNT_POINT]
+#   MOUNT_POINT defaults to /mnt/opi
+set -euo pipefail
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+info()  { echo -e "${GREEN}[+]${NC} $*"; }
+warn()  { echo -e "${YELLOW}[!]${NC} $*"; }
+error() { echo -e "${RED}[-]${NC} $*"; exit 1; }
+
+[[ $EUID -eq 0 ]] || error "Must run as root (sudo)"
+
+SSID="${1:-}"
+PASSPHRASE="${2:-}"
+MOUNT="${3:-/mnt/opi}"
+
+[[ -z "$SSID" || -z "$PASSPHRASE" ]] && {
+    echo "Usage: sudo $0 SSID PASSPHRASE [MOUNT_POINT]"
+    exit 1
+}
+
+[[ -d "$MOUNT/etc" ]] || error "Mount point not valid: $MOUNT — is the SD card mounted?"
+
+# ── WiFi ──────────────────────────────────────────────────────────────────────
+NM_DIR="${MOUNT}/etc/NetworkManager/system-connections"
+NM_FILE="${NM_DIR}/wifi-bb.nmconnection"
+mkdir -p "$NM_DIR"
+cat > "$NM_FILE" << EOF
+[connection]
+id=wifi-bb
+type=wifi
+autoconnect=true
+
+[wifi]
+mode=infrastructure
+ssid=${SSID}
+
+[wifi-security]
+auth-alg=open
+key-mgmt=wpa-psk
+psk=${PASSPHRASE}
+
+[ipv4]
+method=auto
+
+[ipv6]
+method=disabled
+EOF
+chmod 600 "$NM_FILE"
+info "WiFi profile written (${SSID})"
+
+# ── Root password ─────────────────────────────────────────────────────────────
+read -s -r -p "New root password: " ROOT_PASS; echo
+read -s -r -p "Confirm: " ROOT_PASS2; echo
+[[ "$ROOT_PASS" == "$ROOT_PASS2" ]] || error "Passwords do not match"
+HASH=$(openssl passwd -6 "$ROOT_PASS")
+sed -i "s|^root:[^:]*:|root:${HASH}:|" "${MOUNT}/etc/shadow"
+info "Root password set"
+unset ROOT_PASS ROOT_PASS2
+
+# ── SSH authorized_keys (comments stripped) ───────────────────────────────────
+# Drop only the key material — no hostnames, usernames, or tool names in comments
+if [[ -f "${HOME}/.ssh/authorized_keys" ]]; then
+    SSH_DIR="${MOUNT}/root/.ssh"
+    mkdir -p "$SSH_DIR"
+    # Strip comments: keep only type + base64 key, drop the comment field
+    awk '{print $1, $2}' "${HOME}/.ssh/authorized_keys" > "${SSH_DIR}/authorized_keys"
+    chmod 700 "$SSH_DIR"
+    chmod 600 "${SSH_DIR}/authorized_keys"
+    KEY_COUNT=$(wc -l < "${SSH_DIR}/authorized_keys")
+    info "Wrote ${KEY_COUNT} SSH key(s) (comments stripped)"
+else
+    warn "No authorized_keys found at ${HOME}/.ssh/authorized_keys — SSH key auth will not work"
+fi
+
+# ── Hostname ──────────────────────────────────────────────────────────────────
+echo "orangepi" > "${MOUNT}/etc/hostname"
+info "Hostname set to: orangepi"
+
+# ── Bypass first-login wizard ─────────────────────────────────────────────────
+rm -f "${MOUNT}/root/.not_logged_in_yet"
+info "First-login wizard disabled"
+
+echo ""
+info "SD card ready. Unmount, insert, and power on."
+info "Once booted: bash scripts/deploy.sh root@10.0.0.0 --enable-service"