diff --git a/config/aipods/artificer.yaml b/config/aipods/artificer.yaml
index 59ee5bd..f827f85 100644
--- a/config/aipods/artificer.yaml
+++ b/config/aipods/artificer.yaml
@@ -68,7 +68,6 @@ spec:
             keys:
               - id_ed25519
               - known_hosts
-              - config
           projection:
             kind: volume
             mountPath: /home/agentrun/.ssh
diff --git a/src/selftest/cases/76-aipod-spec.ts b/src/selftest/cases/76-aipod-spec.ts
index d50141d..8285cd7 100644
--- a/src/selftest/cases/76-aipod-spec.ts
+++ b/src/selftest/cases/76-aipod-spec.ts
@@ -59,7 +59,10 @@ const selfTest: SelfTestCase = async (context) => {
     const toolCredentials = secretScope.toolCredentials as JsonRecord[];
     assert.equal(toolCredentials.some((item) => item.tool === "github" && ((item.projection as JsonRecord).kind) === "env" && ((item.projection as JsonRecord).envName) === "GH_TOKEN" && ((item.secretRef as JsonRecord).name) === "agentrun-v01-tool-github-pr"), true);
     assert.equal(toolCredentials.some((item) => item.tool === "unidesk-ssh" && ((item.projection as JsonRecord).envName) === "UNIDESK_SSH_CLIENT_TOKEN"), true);
-    assert.equal(toolCredentials.some((item) => item.tool === "github" && ((item.projection as JsonRecord).kind) === "volume" && ((item.projection as JsonRecord).mountPath) === "/home/agentrun/.ssh"), true);
+    const githubSshCredential = toolCredentials.find((item) => item.tool === "github" && item.purpose === "github-ssh") as JsonRecord | undefined;
+    assert.equal(((githubSshCredential?.projection as JsonRecord).kind), "volume");
+    assert.equal(((githubSshCredential?.projection as JsonRecord).mountPath), "/home/agentrun/.ssh");
+    assert.deepEqual(((githubSshCredential?.secretRef as JsonRecord).keys), ["id_ed25519", "known_hosts"]);
     const bundle = task.resourceBundleRef as JsonRecord;
     assert.equal(Object.hasOwn(bundle, "gitMirror"), false);
     const bundles = bundle.bundles as JsonRecord[];
@@ -107,7 +110,7 @@ const selfTest: SelfTestCase = async (context) => {
     assert.equal(commands.some((item) => item.includes("aipod-specs render <name>")), true);
     assert.equal(commands.some((item) => item.includes("queue submit --aipod <name>")), true);
     assertNoSecretLeak(submitPlan);
-    return { name: "aipod-spec", tests: ["aipod-spec-yaml-parser-runtime-compatible", "aipod-spec-artificer-image-ref-render", "aipod-spec-primary-workspace-contract", "aipod-spec-artificer-github-url-render", "aipod-spec-git-mirror-url", "git-fetch-stderr-classification", "resource-bundle-source-authority-validation", "resource-bundle-target-conflict-validation", "queue-submit-aipod-dry-run", "aipod-cli-help"] };
+    return { name: "aipod-spec", tests: ["aipod-spec-yaml-parser-runtime-compatible", "aipod-spec-artificer-image-ref-render", "aipod-spec-primary-workspace-contract", "aipod-spec-artificer-github-url-render", "aipod-spec-artificer-github-ssh-required-keys", "aipod-spec-git-mirror-url", "git-fetch-stderr-classification", "resource-bundle-source-authority-validation", "resource-bundle-target-conflict-validation", "queue-submit-aipod-dry-run", "aipod-cli-help"] };
   } finally {
     await new Promise<void>((resolve) => server.server.close(() => resolve()));
   }