diff --git a/internal/cli/node.go b/internal/cli/node.go
index f7c5583..7f324b8 100644
--- a/internal/cli/node.go
+++ b/internal/cli/node.go
@@ -160,13 +160,14 @@ func joinProxmox(cmd *cobra.Command) error {
 	defer cancel()
 
 	result, err := proxmox.BootstrapProxmox(ctx, proxmox.Options{
-		Host:        joinHost,
-		SSHUser:     joinSSHUser,
-		Password:    password,
-		ProxmoxUser: proxmoxUser,
-		ProxmoxRole: proxmoxRole,
-		SSHPort:     joinSSHPort,
-		Logger:      newLogger(),
+		Host:               joinHost,
+		SSHUser:            joinSSHUser,
+		Password:           password,
+		ProxmoxUser:        proxmoxUser,
+		ProxmoxRole:        proxmoxRole,
+		SSHPort:            joinSSHPort,
+		HostKeyFingerprint: joinHostKeyFP,
+		Logger:             newLogger(),
 	})
 	if err != nil {
 		return fmt.Errorf("proxmox bootstrap: %w", err)
diff --git a/internal/proxmox/bootstrap.go b/internal/proxmox/bootstrap.go
index f4d66a2..256e23a 100644
--- a/internal/proxmox/bootstrap.go
+++ b/internal/proxmox/bootstrap.go
@@ -68,6 +68,11 @@ type Options struct {
 	ProxmoxRole string
 	// SSHPort is the SSH port (default 22).
 	SSHPort int
+	// HostKeyFingerprint is the operator-pinned SSH host key fingerprint
+	// in `SHA256:base64` form (REQ-058, D-044). When non-empty, the
+	// bootstrap dialer uses a pinned-host-key callback instead of the
+	// TOFU known_hosts capture path. Empty falls back to TOFU.
+	HostKeyFingerprint string
 	// Logger receives audit-log entries. If nil, slog.Default() is used.
 	Logger *slog.Logger
 }