diff --git a/cmd/uncloud/machine/add.go b/cmd/uncloud/machine/add.go
index e580533f..31c81a87 100644
--- a/cmd/uncloud/machine/add.go
+++ b/cmd/uncloud/machine/add.go
@@ -62,8 +62,8 @@ func NewAddCommand() *cobra.Command {
 			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		"path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
diff --git a/cmd/uncloud/machine/init.go b/cmd/uncloud/machine/init.go
index 22156e2e..238fb80d 100644
--- a/cmd/uncloud/machine/init.go
+++ b/cmd/uncloud/machine/init.go
@@ -80,8 +80,8 @@ func NewInitCommand() *cobra.Command {
 			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		"Path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -114,7 +114,6 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 		publicIP = &ip
 	}
-	
 	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,
diff --git a/internal/sshexec/ssh.go b/internal/sshexec/ssh.go
index 11ee94f8..435f8880 100644
--- a/internal/sshexec/ssh.go
+++ b/internal/sshexec/ssh.go
@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/psviderski/uncloud/internal/fs"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
 )
@@ -63,6 +64,7 @@ func sshAgentAuth() (ssh.AuthMethod, func(), error) {
 }
 
 func privateKeyAuth(path string) (ssh.AuthMethod, error) {
+	path = fs.ExpandHomeDir(path)
 	key, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("read private key file %q: %w", path, err)