diff --git a/services/openssh.nix b/services/openssh.nix
index e6d5979..3c239a4 100644
--- a/services/openssh.nix
+++ b/services/openssh.nix
@@ -9,9 +9,9 @@ with lib;
 mkIf (elem "openssh" config.machine.services) {
   services.openssh = {
     enable = true;
-    kexAlgorithms = [ "curve25519-sha256@libssh.org" ];
+    settings.KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
     sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
-    startWhenNeeded = true;
+    startWhenNeeded = false;
     settings = {
       KbdInteractiveAuthentication = false;
       PasswordAuthentication = false;