diff --git a/.ci/ansible_tests.py b/.ci/ansible_tests.py
index 6c78bb0c..01a012f5 100755
--- a/.ci/ansible_tests.py
+++ b/.ci/ansible_tests.py
@@ -40,8 +40,8 @@ with ci_lib.Fold('docker_setup'):
 
 
 with ci_lib.Fold('job_setup'):
+    os.chmod(ci_lib.TESTS_SSH_PRIVATE_KEY_FILE, int('0600', 8))
     os.chdir(TESTS_DIR)
-    os.chmod('../data/docker/mitogen__has_sudo_pubkey.key', int('0600', 8))
 
     ci_lib.run("mkdir %s", HOSTS_DIR)
     for path in glob.glob(TESTS_DIR + '/hosts/*'):
diff --git a/.ci/ci_lib.py b/.ci/ci_lib.py
index c078791f..b0c9c04a 100644
--- a/.ci/ci_lib.py
+++ b/.ci/ci_lib.py
@@ -28,6 +28,7 @@ os.chdir(
 )
 
 
+GIT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
 DISTRO_SPECS = os.environ.get(
     'MITOGEN_TEST_DISTRO_SPECS',
     'centos6 centos8 debian9 debian11 ubuntu1604 ubuntu2004',
@@ -36,6 +37,7 @@ IMAGE_TEMPLATE = os.environ.get(
     'MITOGEN_TEST_IMAGE_TEMPLATE',
     'public.ecr.aws/n5z0e8q9/%(distro)s-test',
 )
+TESTS_SSH_PRIVATE_KEY_FILE = os.path.join(GIT_ROOT, 'tests/data/docker/mitogen__has_sudo_pubkey.key')
 
 
 _print = print
@@ -191,20 +193,9 @@ class Fold(object):
     def __exit__(self, _1, _2, _3): pass
 
 
-GIT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
 TMP = TempDir().path
 
 
-# We copy this out of the way to avoid random stuff modifying perms in the Git
-# tree (like git pull).
-src_key_file = os.path.join(GIT_ROOT,
-    'tests/data/docker/mitogen__has_sudo_pubkey.key')
-key_file = os.path.join(TMP,
-    'mitogen__has_sudo_pubkey.key')
-shutil.copyfile(src_key_file, key_file)
-os.chmod(key_file, int('0600', 8))
-
-
 os.environ['PYTHONDONTWRITEBYTECODE'] = 'x'
 os.environ['PYTHONPATH'] = '%s:%s' % (
     os.environ.get('PYTHONPATH', ''),
diff --git a/.ci/debops_common_tests.py b/.ci/debops_common_tests.py
index b065486f..b9b0030c 100755
--- a/.ci/debops_common_tests.py
+++ b/.ci/debops_common_tests.py
@@ -22,6 +22,7 @@ with ci_lib.Fold('docker_setup'):
 
 
 with ci_lib.Fold('job_setup'):
+    os.chmod(ci_lib.TESTS_SSH_PRIVATE_KEY_FILE, int('0600', 8))
     ci_lib.run('debops-init %s', project_dir)
     os.chdir(project_dir)
 
@@ -45,7 +46,7 @@ with ci_lib.Fold('job_setup'):
             "\n"
             # Speed up slow DH generation.
             "dhparam__bits: ['128', '64']\n"
-            % (ci_lib.key_file,)
+            % (ci_lib.TESTS_SSH_PRIVATE_KEY_FILE,)
         )
 
     with open(inventory_path, 'a') as fp:
diff --git a/.ci/localhost_ansible_tests.py b/.ci/localhost_ansible_tests.py
index e4b8329b..29022bf7 100755
--- a/.ci/localhost_ansible_tests.py
+++ b/.ci/localhost_ansible_tests.py
@@ -13,7 +13,6 @@ import ci_lib
 TESTS_DIR = os.path.join(ci_lib.GIT_ROOT, 'tests/ansible')
 IMAGE_PREP_DIR = os.path.join(ci_lib.GIT_ROOT, 'tests/image_prep')
 HOSTS_DIR = os.path.join(TESTS_DIR, 'hosts')
-KEY_PATH = os.path.join(TESTS_DIR, '../data/docker/mitogen__has_sudo_pubkey.key')
 
 
 with ci_lib.Fold('unit_tests'):
@@ -22,7 +21,7 @@ with ci_lib.Fold('unit_tests'):
 
 
 with ci_lib.Fold('job_setup'):
-    os.chmod(KEY_PATH, int('0600', 8))
+    os.chmod(ci_lib.TESTS_SSH_PRIVATE_KEY_FILE, int('0600', 8))
     # NOTE: sshpass v1.06 causes errors so pegging to 1.05 -> "msg": "Error when changing password","out": "passwd: DS error: eDSAuthFailed\n", 
     # there's a checksum error with "brew install http://git.io/sshpass.rb" though, so installing manually
     if not ci_lib.exists_in_path('sshpass'):
diff --git a/docs/changelog.rst b/docs/changelog.rst
index 7ae6e5da..1fbee883 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -24,6 +24,7 @@ In progress (unreleased)
 * :gh:issue:`1121` :mod:`mitogen`: Log skipped :py:mod:`termios` attributes
 * :gh:issue:`1238` packaging: Avoid :py:mod:`ast`, requires Python = 2.6
 * :gh:issue:`1118` CI: Statically specify test usernames and group names
+* :gh:issue:`1118` CI: Don't copy SSH private key to temporary dir
 
 
 v0.3.22 (2025-02-04)