diff --git a/images/fedora-remote/custom.yaml b/images/fedora-remote/custom.yaml
index a84450a..a9925c9 100644
--- a/images/fedora-remote/custom.yaml
+++ b/images/fedora-remote/custom.yaml
@@ -23,6 +23,9 @@ packages:
   # Proxmox guest integration.
   - qemu-guest-agent
 
+  # grd-firstboot generates the RDP TLS certificate with the openssl CLI.
+  - openssl
+
   # Kanidm Unix authentication (kanidm-unixd-clients pulls kanidm-clients).
   - kanidm-unixd-clients
 
diff --git a/images/fedora-remote/files/50-grd.preset b/images/fedora-remote/files/50-grd.preset
index 98187bc..e2d1222 100644
--- a/images/fedora-remote/files/50-grd.preset
+++ b/images/fedora-remote/files/50-grd.preset
@@ -3,3 +3,6 @@ enable gdm.service
 enable gnome-remote-desktop.service
 enable grd-firstboot.service
 enable qemu-guest-agent.service
+
+# Headless host: SSH (Kanidm key auth via 10-kanidm.conf) is the other way in.
+enable sshd.service