diff --git a/scripts/cluster/bootstrap-wireguard.sh b/scripts/cluster/bootstrap-wireguard.sh
index e03c7d2..9827784 100755
--- a/scripts/cluster/bootstrap-wireguard.sh
+++ b/scripts/cluster/bootstrap-wireguard.sh
@@ -15,7 +15,7 @@ public_keys=()
 
 for host in "${hosts[@]}"; do
   echo "[wireguard] preparing $host"
-  public_key=$(cluster_ssh "$host" 'bash -s' <<'REMOTE'
+  public_key=$(cluster_ssh "$host" 'bash -s' <<'REMOTE' | tail -n 1
 set -euo pipefail
 export DEBIAN_FRONTEND=noninteractive
 if ! command -v wg >/dev/null 2>&1; then