diff --git a/ansible/group_vars/all/semaphore.yml b/ansible/group_vars/all/semaphore.yml
index 13210ea..02e64bd 100644
--- a/ansible/group_vars/all/semaphore.yml
+++ b/ansible/group_vars/all/semaphore.yml
@@ -90,7 +90,10 @@ semaphore_config:
       # wed is the universal automation account pre-baked in every VM
       # template. Semaphore uses it for fleet-wide jobs.
       ssh_key: wed-ssh
-      become_key: wed-ssh
+      # become_key is Semaphore's sudo PASSWORD slot, not a second SSH
+      # key. wed has passwordless sudo on every host, so reference the
+      # built-in "None" key. (Semaphore rejects an SSH-type key here.)
+      become_key: None
 
   environments:
     - name: default