diff --git a/live/deploy/dryrun.sh b/live/deploy/dryrun.sh
index 6c68ea3..1f93a32 100755
--- a/live/deploy/dryrun.sh
+++ b/live/deploy/dryrun.sh
@@ -66,7 +66,7 @@ if grep -qi "Host key verification failed" "$err"; then
        再在这台上写入并核对：
          sudo -u $USER_NAME ssh-keyscan -t ed25519 <采集机IP> \\
            | sudo -u $USER_NAME tee -a $STATE/home/.ssh/known_hosts
-         ssh-keygen -lf $STATE/home/.ssh/known_hosts   # 比对指纹是否一致"
+         sudo -u $USER_NAME ssh-keygen -lf $STATE/home/.ssh/known_hosts"
 elif grep -qiE "Permission denied|publickey" "$err"; then
     rm -f "$err" "$outf"
     die "认证被拒。指纹是通的，是 key 没装到采集机上：
diff --git a/live/deploy/install.sh b/live/deploy/install.sh
index 9ef2f38..e5399f0 100755
--- a/live/deploy/install.sh
+++ b/live/deploy/install.sh
@@ -190,7 +190,7 @@ echo "     还要写 known_hosts，否则报 Host key verification failed ——
 echo "     起来会撞同一个墙，因为 BatchMode=yes 不允许交互确认："
 echo "     sudo -u $USER_NAME ssh-keyscan -t ed25519 <采集机IP> \\"
 echo "       | sudo -u $USER_NAME tee -a $STATE/home/.ssh/known_hosts"
-echo "     ssh-keygen -lf $STATE/home/.ssh/known_hosts"
+echo "     sudo -u $USER_NAME ssh-keygen -lf $STATE/home/.ssh/known_hosts"
 echo "     # 把指纹跟采集机上 ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub"
 echo "     # 的输出比一遍。**不要**图省事用 StrictHostKeyChecking=no，"
 echo "     # 那等于放弃中间人防护，而这条链路上跑的是下单信号"