diff --git a/machines/node/users.nix b/machines/node/users.nix
index a3e8cec..4dbcff3 100644
--- a/machines/node/users.nix
+++ b/machines/node/users.nix
@@ -23,7 +23,9 @@ with lib;
     extraConfig = ''
       IgnoreRhosts no
 
-      Match Group cluster
+      DenyGroups !vip,cluster
+
+      Match Group vip
         HostbasedAuthentication yes
         HostbasedAcceptedAlgorithms ssh-ed25519*
         HostbasedUsesNameFromPacketOnly yes