diff --git a/internal/cli/node.go b/internal/cli/node.go
index 0a41ada..f7c5583 100644
--- a/internal/cli/node.go
+++ b/internal/cli/node.go
@@ -45,18 +45,19 @@ func nodeRegistry() (*engine.NodeRegistry, func() error, error) {
 }
 
 var (
-	joinName     string
-	joinAddr     string
-	joinCAFinger string
-	joinType     string
-	joinHost     string
-	joinSSHUser  string
-	joinPassword string
-	joinSSHPort  int
-	proxmoxUser  string
-	proxmoxRole  string
-	leaveID      string
-	nodeWatch    bool
+	joinName      string
+	joinAddr      string
+	joinCAFinger  string
+	joinType      string
+	joinHost      string
+	joinSSHUser   string
+	joinPassword  string
+	joinSSHPort   int
+	joinHostKeyFP string
+	proxmoxUser   string
+	proxmoxRole   string
+	leaveID       string
+	nodeWatch     bool
 )
 
 var nodeCmd = &cobra.Command{
@@ -76,6 +77,9 @@ Node types (via --type):
                        (deploys orca pubkey, creates orca user + PVE role +
                        sudoers allowlist; requires --host + --password)`,
 	RunE: func(cmd *cobra.Command, args []string) error {
+		if joinHostKeyFP != "" && joinType != "proxmox" {
+			return fmt.Errorf("--host-key-fingerprint requires --type proxmox today")
+		}
 		if joinType == "proxmox" {
 			return joinProxmox(cmd)
 		}
@@ -352,6 +356,7 @@ func init() {
 	nodeJoinCmd.Flags().IntVar(&joinSSHPort, "ssh-port", 22, "SSH port for proxmox bootstrap (default 22)")
 	nodeJoinCmd.Flags().StringVar(&proxmoxUser, "proxmox-user", "orca", "Linux system user to create on the proxmox host (config-overridable)")
 	nodeJoinCmd.Flags().StringVar(&proxmoxRole, "proxmox-role", "OrcaOperator", "PVE custom role to create (config-overridable)")
+	nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "SSH host key SHA256:base64 fingerprint (pre-pin; supersedes TOFU for --type proxmox)")
 	nodeLeaveCmd.Flags().StringVar(&leaveID, "id", "", "node id")
 	nodeListCmd.Flags().BoolVar(&nodeWatch, "watch", false, "stream nodes until Ctrl-C (table refresh or --json per-event)")