diff --git a/scripts/farm/farm-down.sh b/scripts/farm/farm-down.sh
index 6ba0d013..127ae9c8 100755
--- a/scripts/farm/farm-down.sh
+++ b/scripts/farm/farm-down.sh
@@ -16,7 +16,9 @@ SSH_KEY="${SSH_KEY:-$HOME/.ssh/github5}"
 REMOTE="${REMOTE:-/opt/hammer}"
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 FLEET="$ROOT/scripts/farm/.fleet"
-SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
+# Ver nota en farm-up.sh: workers efímeros reciclan IPs ⇒ known_hosts a /dev/null (hub-and-spoke,
+# worker sin secretos, sin superficie MITM que proteger).
+SSH="ssh -i $SSH_KEY -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR -o ConnectTimeout=10"
 cd "$ROOT"
 [ -s "$FLEET" ] || { echo "flota vacía (scripts/farm/.fleet)"; exit 0; }
 
diff --git a/scripts/farm/farm-run.sh b/scripts/farm/farm-run.sh
index ca9d1dfb..0f7f0a65 100755
--- a/scripts/farm/farm-run.sh
+++ b/scripts/farm/farm-run.sh
@@ -26,7 +26,9 @@ MAXWAIT="${MAXWAIT:-21600}"
 SSH_KEY="${SSH_KEY:-$HOME/.ssh/github5}"
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 FLEET="$ROOT/scripts/farm/.fleet"
-SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
+# Ver nota en farm-up.sh: workers efímeros reciclan IPs ⇒ known_hosts a /dev/null (hub-and-spoke,
+# worker sin secretos, sin superficie MITM que proteger).
+SSH="ssh -i $SSH_KEY -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR -o ConnectTimeout=10"
 cd "$ROOT"
 
 cycles() { $SSH "root@$1" 'journalctl -u hammer-farm -o cat --no-pager 2>/dev/null | grep -c "ciclo terminado"' 2>/dev/null || echo 0; }
diff --git a/scripts/farm/farm-up.sh b/scripts/farm/farm-up.sh
index 5d3f3244..7f938f0b 100755
--- a/scripts/farm/farm-up.sh
+++ b/scripts/farm/farm-up.sh
@@ -26,7 +26,11 @@ SSH_KEY="${SSH_KEY:-$HOME/.ssh/github5}"
 REMOTE="${REMOTE:-/opt/hammer}"
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 FLEET="$ROOT/scripts/farm/.fleet"
-SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
+# Workers efímeros RECICLAN IPs de Hetzner ⇒ un known_hosts persistente choca ("HOST KEY CHANGED")
+# y accept-new RECHAZA la clave cambiada, colgando el `until ssh true` para siempre. Como el modelo
+# es hub-and-spoke (el worker NO tiene secretos: compute puro descartable), saltamos la verificación
+# de host y no ensuciamos known_hosts (/dev/null). No hay superficie MITM que proteger acá.
+SSH="ssh -i $SSH_KEY -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR -o ConnectTimeout=10"
 cd "$ROOT"
 touch "$FLEET"