diff --git a/k8s/awoooi-prod/06-deployment-api.yaml b/k8s/awoooi-prod/06-deployment-api.yaml
index e9a22c0c..f2a8dfec 100644
--- a/k8s/awoooi-prod/06-deployment-api.yaml
+++ b/k8s/awoooi-prod/06-deployment-api.yaml
@@ -72,8 +72,15 @@ spec:
               subPath: service-registry.yaml
               readOnly: true
             # MCP Phase 2a (2026-04-11 Claude Sonnet 4.6): SSH MCP key
+            # ssh_mcp_key → /run/secrets/ssh_mcp_key (SSH_KEY_PATH in ssh_provider.py)
+            # known_hosts → /etc/ssh-mcp/known_hosts (SSH_MCP_KNOWN_HOSTS_FILE)
             - name: ssh-mcp-key
-              mountPath: /etc/ssh-mcp
+              mountPath: /run/secrets/ssh_mcp_key
+              subPath: ssh_mcp_key
+              readOnly: true
+            - name: ssh-mcp-key
+              mountPath: /etc/ssh-mcp/known_hosts
+              subPath: known_hosts
               readOnly: true
           resources:
             requests: