diff --git a/scripts/install-main.sh b/scripts/install-main.sh
index d736866..f55a39e 100755
--- a/scripts/install-main.sh
+++ b/scripts/install-main.sh
@@ -1,6 +1,12 @@
 #!/bin/bash
 set -euo pipefail
 
+DOTFILES="${HOME}/.config/literate-dotfiles"
+
+tangle() {
+    emacs --batch -l org --eval "(org-babel-tangle-file \"${DOTFILES}/$1\")"
+}
+
 echo "==> Shell and Terminal"
 paru -S --needed \
     bash bash-completion zsh \
@@ -106,3 +112,68 @@ paru -S --needed \
     xwallpaper \
     highlight-pointer-git \
     mpd
+
+setup_ssh_key() {
+    local key_name="$1"
+    local remote_host="$2"
+    local remote_port="${3:-22}"
+    local key_file="$HOME/.ssh/id_ed25519_${key_name}"
+
+    echo ""
+    echo "==> Setting up SSH key for ${key_name}"
+
+    # Generate key if it doesn't exist
+    if [ ! -f "${key_file}" ]; then
+        read -p "Generate new SSH key for ${key_name}? [y/N] " -n 1 -r
+        echo
+        if [[ $REPLY =~ ^[Yy]$ ]]; then
+            ssh-keygen -t ed25519 -C "${key_name}-tunnel" -f "${key_file}" -N ""
+        else
+            echo "Skipping ${key_name} key generation"
+            return 1
+        fi
+    fi
+
+    # Check if we can connect without password
+    if ssh -o BatchMode=yes -o ConnectTimeout=5 -p "${remote_port}" -i "${key_file}" "${remote_host}" exit 2>/dev/null; then
+        echo "SSH key for ${key_name} is already deployed ✓"
+        return 0
+    fi
+
+    # Prompt to deploy key
+    read -p "Deploy SSH key to ${remote_host}? [y/N] " -n 1 -r
+    echo
+    if [[ $REPLY =~ ^[Yy]$ ]]; then
+        ssh-copy-id -i "${key_file}.pub" -p "${remote_port}" "${remote_host}"
+    else
+        echo "Skipping ${key_name} key deployment"
+        return 1
+    fi
+}
+
+# Setup homelab key
+setup_ssh_key "homelab" "homelab" 22
+HOMELAB_OK=$?
+
+# Setup ESRF key
+setup_ssh_key "esrf" "dehaeze@firewall.esrf.fr" 8022
+ESRF_OK=$?
+
+echo "==> Tangling systemd configs"
+tangle "systemd.org"
+
+echo "==> Enabling systemd services"
+
+if [ $HOMELAB_OK -eq 0 ]; then
+    systemctl --user enable --now homelab-tunnel
+else
+    echo "  Skipping homelab-tunnel (SSH key not configured)"
+fi
+
+if [ $ESRF_OK -eq 0 ]; then
+    systemctl --user enable --now esrf-tunnel
+else
+    echo "  Skipping esrf-tunnel (SSH key not configured)"
+fi
+
+systemctl --user enable --now syncthing