diff --git a/bootstrap/platform/main.tf b/bootstrap/platform/main.tf
index 1ec58c9..33f7969 100644
--- a/bootstrap/platform/main.tf
+++ b/bootstrap/platform/main.tf
@@ -1025,16 +1025,30 @@ if [ -z "$${repo_host}" ] || [ -z "$${repo_port}" ]; then
 fi
 
 known_hosts_file="$(mktemp)"
+known_hosts_scan="$(mktemp)"
 known_hosts_sorted="$(mktemp)"
-trap 'rm -f "$${known_hosts_file}" "$${known_hosts_sorted}"' EXIT
+trap 'rm -f "$${known_hosts_file}" "$${known_hosts_scan}" "$${known_hosts_sorted}"' EXIT
 
 kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" get configmap argocd-ssh-known-hosts-cm \
   -o jsonpath='{.data.ssh_known_hosts}' > "$${known_hosts_file}" 2>/dev/null || true
 if [ "$${repo_port}" = "22" ]; then
-  ssh-keyscan -H "$${repo_host}" >> "$${known_hosts_file}" 2>/dev/null
+  keyscan_cmd=(ssh-keyscan -T 10 -H "$${repo_host}")
 else
-  ssh-keyscan -H -p "$${repo_port}" "$${repo_host}" >> "$${known_hosts_file}" 2>/dev/null
+  keyscan_cmd=(ssh-keyscan -T 10 -H -p "$${repo_port}" "$${repo_host}")
 fi
+if ! "$${keyscan_cmd[@]}" > "$${known_hosts_scan}" 2>&1; then
+  echo "Could not scan GitOps SSH host key for $${repo_host}:$${repo_port}." >&2
+  cat "$${known_hosts_scan}" >&2
+  echo "Check Gitea SSH with: ssh-keyscan -T 10 -p $${repo_port} $${repo_host}" >&2
+  echo "Then verify auth with: ssh -T -p $${repo_port} git@$${repo_host}" >&2
+  exit 1
+fi
+if ! grep -Eq '^[^#[:space:]]+[[:space:]]+(ssh-|ecdsa-)' "$${known_hosts_scan}"; then
+  echo "ssh-keyscan returned no usable GitOps SSH host keys for $${repo_host}:$${repo_port}." >&2
+  cat "$${known_hosts_scan}" >&2
+  exit 1
+fi
+cat "$${known_hosts_scan}" >> "$${known_hosts_file}"
 sort -u "$${known_hosts_file}" > "$${known_hosts_sorted}"
 kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" create configmap argocd-ssh-known-hosts-cm \
   --from-file=ssh_known_hosts="$${known_hosts_sorted}" \
diff --git a/jeannie b/jeannie
index 87780b7..fbdd88f 100755
--- a/jeannie
+++ b/jeannie
@@ -4913,6 +4913,24 @@ apps() {
     echo "Application deployment successfully completed."
 }
 
+edge_apply() {
+    require_debian_server "edge"
+
+    if [[ -z "${TF_VAR_haproxy_stats_password:-}" ]] ||
+        ((${#TF_VAR_haproxy_stats_password} < 12)) ||
+        [[ "${TF_VAR_haproxy_stats_password}" == "adminpassword" ]]; then
+        cat >&2 <<'EOF'
+TF_VAR_haproxy_stats_password must be set to a non-default value with at least 12 characters before applying the edge stack.
+Example:
+  export TF_VAR_haproxy_stats_password='<existing-edge-stats-password>'
+  ./jeannie edge
+EOF
+        exit 1
+    fi
+
+    run_tofu_stack "bootstrap/edge"
+}
+
 ensure_cluster_worker_var_file() {
     if [[ -z "${LAB_CLUSTER_VAR_FILE:-}" ]]; then
         prepare_cluster_worker_var_file false
@@ -7434,6 +7452,7 @@ Operator View And Reports
 Observability And GitOps
   grafana-dashboards {list|apply}            List or apply repo-managed Grafana dashboards.
   gitops-status                              Print focused Argo CD health and sync status.
+  edge                                       Deploy/check the OCI edge stack only.
   promote {plan|validate|rollback APP}       Run canary promotion gates and rollback plan.
   cert-check                                 Check public DNS, TLS, and edge URL health.
   backup-status                              Check backup and restore-drill freshness.
@@ -7555,6 +7574,10 @@ case "${1:-}" in
     gitops-status)
         gitops_status
         ;;
+    edge)
+        record_change_journal "edge" "$@"
+        edge_apply
+        ;;
     promote)
         promote "$@"
         ;;