diff --git a/hw/dixie/analysis.nix b/hw/dixie/analysis.nix
index 7155ad5..1ffea35 100644
--- a/hw/dixie/analysis.nix
+++ b/hw/dixie/analysis.nix
@@ -43,6 +43,13 @@ in
       home = "/home/dropsonde";
       createHome = true;
       shell = pkgs.bash;
+      # Hyperborea's nightly sync key (collector -> dixie). rrsync -wo /srv
+      # is the whole capability: write-only rsync rooted at /srv, no shell.
+      # rrsync is a separate nixpkgs package (not bundled with pkgs.rsync);
+      # its rsync + python paths are pinned to the store, so no PATH needed.
+      openssh.authorizedKeys.keys = [
+        ''command="${pkgs.rrsync}/bin/rrsync -wo /srv",no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOGU2ZPL8d5iDWo/PIGRtulLbFqOL8XapgZPp1i8oii dropsonde-sync''
+      ];
     };
     users.groups.dropsonde = {};