diff --git a/includes/90-root-authorized-keys.sh b/includes/90-root-authorized-keys.sh
new file mode 100644
index 0000000..730907f
--- /dev/null
+++ b/includes/90-root-authorized-keys.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# Configure root ssh authorized_keys file if available via mdata
+
+if mdata-get root_authorized_keys 1>/dev/null 2>&1; then
+  install --directory --mode=700 /root/.ssh
+  echo "# This file is managed by mdata-get root_authorized_keys" \
+    > /root/.ssh/authorized_keys
+  mdata-get root_authorized_keys >> /root/.ssh/authorized_keys
+  chmod 644 /root/.ssh/authorized_keys
+fi