diff --git a/scripts/felhom-host-install.sh b/scripts/felhom-host-install.sh
index 5530047..a9b6e83 100644
--- a/scripts/felhom-host-install.sh
+++ b/scripts/felhom-host-install.sh
@@ -144,17 +144,17 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="1.11.0"   # keep in sync with the header line at the top of this file
+SCRIPT_VERSION="1.11.1"   # keep in sync with the header line at the top of this file
 
 # Operator signing keys pinned at day-0 (GL-4; doc 04 §3 two-key model). EMPTY by default — the pin
 # CEREMONY is an operator step: generate the real keypairs OFFLINE, then fill these four constants
 # in one commit (or pass --operator-pubkey-file at install time, which overrides them). Empty =
 # no authz.signers written = agent self-update stays DORMANT (the safe default; the verify step
 # warns). PUBLIC keys only — this script never generates, reads, or references private key material.
-OPERATOR_KEY_OPERATIONAL_ID=""    # key_id = the authorized_keys comment, e.g. "felhom-op-1"
-OPERATOR_KEY_OPERATIONAL_LINE=""  # full authorized_keys line: "ssh-ed25519 AAAA… felhom-op-1"
-OPERATOR_KEY_RECOVERY_ID=""       # cold key; authorizes only key-rotation/break-glass
-OPERATOR_KEY_RECOVERY_LINE=""
+OPERATOR_KEY_OPERATIONAL_ID="felhom-op-1"
+OPERATOR_KEY_OPERATIONAL_LINE="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL8z0qCNgA3x2xxAB0Qj5ro8waFjGZ8Ta/sWB63tlLw+ felhom-op-1"
+OPERATOR_KEY_RECOVERY_ID="felhom-rec-1"
+OPERATOR_KEY_RECOVERY_LINE="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/gZI5mvXmUzImh81iHdjdVYwmQ4fRGKqn+9td0fI5/ felhom-rec-1"
 
 #-------------------------------------------------------------------------------
 # Logging (mirrors felhom-controller/scripts/docker-setup.sh)