diff --git a/apps/rego-tunnel/build/start-vm.sh b/apps/rego-tunnel/build/start-vm.sh
index 8d80cbf..345ca30 100755
--- a/apps/rego-tunnel/build/start-vm.sh
+++ b/apps/rego-tunnel/build/start-vm.sh
@@ -1,13 +1,12 @@
 #!/bin/bash
 set -euo pipefail
 
-# If provided, extract ssh.zip to /root/.ssh/zip (not baked into the image)
+# If provided, extract ssh.zip to /root/.ssh (not baked into the image)
 SSH_ZIP_PATH="/shared/ssh.zip"
-SSH_ZIP_DEST="/root/.ssh/zip"
+SSH_ZIP_DEST="/root/.ssh"
 
 if [ -f "$SSH_ZIP_PATH" ]; then
 	mkdir -p "$SSH_ZIP_DEST"
-	chmod 700 /root/.ssh
 	chmod 700 "$SSH_ZIP_DEST"
 
 	echo "[rego-tunnel] Extracting $SSH_ZIP_PATH -> $SSH_ZIP_DEST"