diff --git a/ansible/group_vars/all/semaphore.yml b/ansible/group_vars/all/semaphore.yml
index a6b9f2c..13210ea 100644
--- a/ansible/group_vars/all/semaphore.yml
+++ b/ansible/group_vars/all/semaphore.yml
@@ -60,7 +60,17 @@ semaphore_config:
       ssh_login: git
       ssh_private_key: "{{ vault_gitea_deploy_key }}"
 
-    # SSH key Semaphore uses to reach the fleet as jarvis.
+    # SSH key for the universal automation account 'wed' — pre-baked in
+    # every mk-labs VM template. This is the canonical user Semaphore
+    # uses to reach the fleet.
+    - name: wed-ssh
+      type: ssh
+      ssh_login: wed
+      ssh_private_key: "{{ vault_wed_ssh_private_key }}"
+
+    # SSH key Semaphore can use to reach the fleet as jarvis (admin
+    # account provisioned by linux-baseline). Retained for jobs that
+    # specifically need jarvis-level access; the default is wed-ssh.
     - name: jarvis-ssh
       type: ssh
       ssh_login: jarvis
@@ -77,8 +87,10 @@ semaphore_config:
       type: file
       inventory_file: ansible/inventory.yml
       repository: homelab
-      ssh_key: jarvis-ssh
-      become_key: jarvis-ssh
+      # wed is the universal automation account pre-baked in every VM
+      # template. Semaphore uses it for fleet-wide jobs.
+      ssh_key: wed-ssh
+      become_key: wed-ssh
 
   environments:
     - name: default