diff --git a/scripts/harden-ssh.sh b/scripts/harden-ssh.sh
index 9bdfe70..cebbf71 100644
--- a/scripts/harden-ssh.sh
+++ b/scripts/harden-ssh.sh
@@ -69,6 +69,14 @@ die()  { printf '\033[1;31m[x]\033[0m %s\n' "$*" >&2; exit 1; }
 # ----------------------------------------------------------------------------
 # 1. Pre-flight checks
 # ----------------------------------------------------------------------------
+# Ensure ssh client is installed before probing its version. On a fresh
+# Alpine box there's no `ssh` binary at all, and the version-detect
+# pipeline below would die silently under `set -euo pipefail`.
+if ! command -v ssh >/dev/null 2>&1; then
+    log "ssh not found; installing openssh + openssh-server..."
+    apk add -q openssh openssh-server
+fi
+
 log "Checking OpenSSH version supports PQ KEX..."
 SSH_VER=$(ssh -V 2>&1 | grep -oE 'OpenSSH_[0-9]+\.[0-9]+' | head -1 \
           | sed 's/OpenSSH_//')