diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java
index d5c61459a..f5f2d18c2 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/IdentityChoiceBuilder.java
@@ -47,6 +47,7 @@ public class IdentityChoiceBuilder {
     boolean requirePassword;
     boolean keyInput;
     boolean requireKeyInput;
+    boolean allowKeygen;
     String userChoiceTranslationKey;
     ObservableValue<String> passwordChoiceTranslationKey;
     ObservableValue<DataStoreEntryRef<ShellStore>> fileSystem;
@@ -59,6 +60,7 @@ public class IdentityChoiceBuilder {
             boolean requirePassword,
             boolean keyInput,
             boolean requireKeyInput,
+            boolean allowKeygen,
             String userChoiceTranslationKey,
             String passwordChoiceTranslationKey) {
         this.syncedBase = syncedBase;
@@ -68,6 +70,7 @@ public class IdentityChoiceBuilder {
         this.requirePassword = requirePassword;
         this.keyInput = keyInput;
         this.requireKeyInput = requireKeyInput;
+        this.allowKeygen = allowKeygen;
         this.userChoiceTranslationKey = userChoiceTranslationKey;
         this.passwordChoiceTranslationKey = new ReadOnlyStringWrapper(passwordChoiceTranslationKey);
         this.fileSystem = new ReadOnlyObjectWrapper<>(DataStorage.get().local().ref());
@@ -130,24 +133,28 @@ public class IdentityChoiceBuilder {
     public static OptionsBuilder ssh(
             ObjectProperty<IdentityValue> identity, ObservableBooleanValue syncedBase, boolean requireUser) {
         var i = new IdentityChoiceBuilder(
-                identity, syncedBase, true, requireUser, true, true, true, "identityChoice", "passwordAuthentication");
+                identity, syncedBase, true, requireUser, true, true, true, false, "identityChoice", "passwordAuthentication");
         return i.build();
     }
 
     public static OptionsBuilder container(ObjectProperty<IdentityValue> identity, ObservableBooleanValue syncedBase) {
         var i = new IdentityChoiceBuilder(
-                identity, syncedBase, true, false, false, false, false, "customUsername", "customUsernamePassword");
+                identity, syncedBase, true, false, false, false, false, false, "customUsername", "customUsernamePassword");
         return i.build();
     }
 
     public static OptionsBuilder keyAuthChoice(
-            Property<SshIdentityStrategy> identity, SshIdentityStrategyChoiceConfig config) {
+            Property<SshIdentityStrategy> identity, SshIdentityStrategyChoiceConfig config, boolean allowKeygen) {
         return OptionsChoiceBuilder.builder()
                 .allowNull(false)
                 .property(identity)
                 .customConfiguration(config)
                 .available(AuthModuleProvider.get().getSshIdentityStrategyClasses())
                 .transformer(entryComboBox -> {
+                    if (!allowKeygen) {
+                        return entryComboBox;
+                    }
+
                     var button = new ButtonComp(null, new LabelGraphic.IconGraphic("mdi2k-key-plus"), () -> {
                         ProcModuleProvider.get().showSshKeygenDialog(null, identity);
                     });
@@ -226,7 +233,7 @@ public class IdentityChoiceBuilder {
             options.name("keyAuthentication")
                     .description("keyAuthenticationDescription")
                     .documentationLink(DocumentationLink.SSH_KEYS)
-                    .sub(keyAuthChoice(identityStrategy, sshIdentityChoiceConfig), identityStrategy)
+                    .sub(keyAuthChoice(identityStrategy, sshIdentityChoiceConfig, allowKeygen), identityStrategy)
                     .nonNullIf(inPlaceSelected.and(new ReadOnlyBooleanWrapper(requireKeyInput)))
                     .hide(refSelected);
         }
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java
index d6096b1cc..0529b37fa 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/LocalIdentityStoreProvider.java
@@ -60,7 +60,7 @@ public class LocalIdentityStoreProvider extends IdentityStoreProvider {
                 .name("keyAuthentication")
                 .description("keyAuthenticationDescription")
                 .documentationLink(DocumentationLink.SSH_KEYS)
-                .sub(IdentityChoiceBuilder.keyAuthChoice(identity, sshIdentityChoiceConfig), identity)
+                .sub(IdentityChoiceBuilder.keyAuthChoice(identity, sshIdentityChoiceConfig, true), identity)
                 .bind(
                         () -> {
                             return LocalIdentityStore.builder()
diff --git a/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java b/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java
index 912149b2b..63911964b 100644
--- a/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java
+++ b/ext/base/src/main/java/io/xpipe/ext/base/identity/SyncedIdentityStoreProvider.java
@@ -101,7 +101,7 @@ public class SyncedIdentityStoreProvider extends IdentityStoreProvider {
                 .name("keyAuthentication")
                 .description("keyAuthenticationDescription")
                 .documentationLink(DocumentationLink.SSH_KEYS)
-                .sub(IdentityChoiceBuilder.keyAuthChoice(identity, sshIdentityChoiceConfig), identity)
+                .sub(IdentityChoiceBuilder.keyAuthChoice(identity, sshIdentityChoiceConfig, true), identity)
                 .check(val -> Validator.create(val, AppI18n.observable("keyNotSynced"), identity, i -> {
                     var wrong = i instanceof KeyFileStrategy f
                             && f.getFile() != null