diff --git a/hub/onboard-spoke.sh b/hub/onboard-spoke.sh
index 26a905b..3eaea95 100644
--- a/hub/onboard-spoke.sh
+++ b/hub/onboard-spoke.sh
@@ -31,7 +31,9 @@ mkdir -p "$(dirname "$RCLONE_CONF")"
 
 header "Checking Tunnel"
 info "Scanning spoke host key..."
-ssh-keyscan -p "$TUNNEL_PORT" -H localhost >> "$SSH_DIR/known_hosts" 2>/dev/null
+KEYSCAN=$(ssh-keyscan -p "$TUNNEL_PORT" -H localhost 2>/dev/null)
+[ -n "$KEYSCAN" ] || die "Spoke not reachable on port $TUNNEL_PORT — is the tunnel up?"
+echo "$KEYSCAN" >> "$SSH_DIR/known_hosts"
 
 info "Verifying spoke is reachable on port $TUNNEL_PORT..."
 if ssh -o BatchMode=yes -o ConnectTimeout=10 -p "$TUNNEL_PORT" armbian@localhost exit 2>/dev/null; then