diff --git a/lib/bat/bosh_helper.rb b/lib/bat/bosh_helper.rb
index b5348be..c8db7eb 100644
--- a/lib/bat/bosh_helper.rb
+++ b/lib/bat/bosh_helper.rb
@@ -63,6 +63,16 @@ def ssh(host, user, command, options = {})
       raise 'Need to set ssh :private_key' if options[:private_key].nil?
       ssh_options[:key_data] = [options[:private_key]]
 
+      # Offer the deployment's key and nothing else. Net::SSH otherwise adds
+      # every IdentityFile from ~/.ssh/config, which it tries before :key_data,
+      # plus every identity loaded in the ssh-agent. Enough extra identities
+      # exhaust the target sshd's MaxAuthTries and it disconnects the example
+      # with "Too many authentication failures". :keys_only alone is not
+      # enough: it filters agent identities but not the config file's.
+      ssh_options[:keys] = []
+      ssh_options[:keys_only] = true
+      ssh_options[:use_agent] = false
+
       @logger.info("--> ssh options: #{ssh_options.inspect}")
 
       if options[:gateway_host] && options[:gateway_username]
diff --git a/spec/bat/bosh_helper_spec.rb b/spec/bat/bosh_helper_spec.rb
index 543f860..d9d4a03 100644
--- a/spec/bat/bosh_helper_spec.rb
+++ b/spec/bat/bosh_helper_spec.rb
@@ -49,6 +49,20 @@
     end
   end
 
+  describe '#ssh' do
+    it 'offers the given private key and no other identity' do
+      captured = nil
+      allow(Net::SSH).to receive(:start) { |_host, _user, options| captured = options }
+
+      bosh_helper.ssh('10.0.0.1', 'vcap', 'echo hello', private_key: 'private')
+
+      expect(captured[:key_data]).to eq(['private'])
+      expect(captured[:keys]).to eq([])
+      expect(captured[:keys_only]).to be(true)
+      expect(captured[:use_agent]).to be(false)
+    end
+  end
+
   describe 'persistent_disk' do
     let(:job_name) { 'some-job' }
     let(:job_index) { 'some-index' }