diff --git a/buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear-lifecycle.service b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear-lifecycle.service
new file mode 100644
index 00000000000..714887b4867
--- /dev/null
+++ b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear-lifecycle.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Start or stop dropbear based on SSH authorized_keys
+RequiresMountsFor=/root/.ssh
+
+[Service]
+# Idempotent on purpose: the path unit may fire for any change in the watched
+# directory (e.g. temporary files from atomic writes), so this must converge
+# rather than toggle.
+Type=oneshot
+ExecStart=/bin/sh -c 'if [ -s /root/.ssh/authorized_keys ]; then systemctl start dropbear.service; else systemctl stop dropbear.service; fi'
diff --git a/buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear.path b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear.path
new file mode 100644
index 00000000000..e50ff1c5b6d
--- /dev/null
+++ b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear.path
@@ -0,0 +1,17 @@
+[Unit]
+Description=Watch SSH authorized_keys for debug SSH access
+# The watch must be armed on the bind-mounted directory (inotify events do
+# not cross mount points), and before haos-config potentially imports keys.
+RequiresMountsFor=/root/.ssh
+Before=haos-config.service
+
+[Path]
+# Edge-triggered on purpose: PathExists= pointed at a oneshot unit that does
+# not consume the file would re-trigger until the start rate limit is hit.
+# Presence of keys at boot is instead handled by dropbear.service itself,
+# which is enabled and gated by ConditionFileNotEmpty.
+PathChanged=/root/.ssh/authorized_keys
+Unit=dropbear-lifecycle.service
+
+[Install]
+WantedBy=multi-user.target
diff --git a/buildroot-external/rootfs-overlay/usr/sbin/haos-config b/buildroot-external/rootfs-overlay/usr/sbin/haos-config
index b4b6c8066ad..54e7a0225ee 100755
--- a/buildroot-external/rootfs-overlay/usr/sbin/haos-config
+++ b/buildroot-external/rootfs-overlay/usr/sbin/haos-config
@@ -76,13 +76,10 @@ if [ -f "${CONFIG_DIR}/authorized_keys" ]; then
 
     cp -f ${CONFIG_DIR}/authorized_keys /root/.ssh/authorized_keys
     chmod 600 /root/.ssh/authorized_keys
-
-    systemctl start dropbear > /dev/null 2>&1
 else
     echo "[Info] Stop SSH debug access"
 
     rm -f /root/.ssh/authorized_keys
-    systemctl stop dropbear > /dev/null 2>&1
 fi
 
 ##