diff --git a/core/installer/server/dodo-app/server.go b/core/installer/server/dodo-app/server.go
index 2bbbb7c..5e0e2e0 100644
--- a/core/installer/server/dodo-app/server.go
+++ b/core/installer/server/dodo-app/server.go
@@ -1709,7 +1709,7 @@
 		fmt.Println(err)
 		return
 	}
-	keyToUser := make(map[string]string)
+	existingPublicKeys := make(map[string]struct{})
 	for _, clientUser := range allClientUsers {
 		if clientUser == "admin" || clientUser == "fluxcd" {
 			continue
@@ -1728,15 +1728,19 @@
 			}
 			for _, existingKey := range existingKeys {
 				cleanKey := soft.CleanKey(existingKey)
-				keyOk := slices.ContainsFunc(userData.SSHPublicKeys, func(key string) bool {
+				found := slices.ContainsFunc(userData.SSHPublicKeys, func(key string) bool {
 					return cleanKey == soft.CleanKey(key)
 				})
-				if !keyOk {
+				if !found {
 					if err := s.client.RemovePublicKey(clientUser, existingKey); err != nil {
 						fmt.Println(err)
 					}
 				} else {
-					keyToUser[cleanKey] = clientUser
+					if _, ok := existingPublicKeys[cleanKey]; ok {
+						fmt.Println(fmt.Errorf("duplicate key: %s", cleanKey))
+						return
+					}
+					existingPublicKeys[cleanKey] = struct{}{}
 				}
 			}
 		}
@@ -1762,15 +1766,11 @@
 		} else {
 			for _, key := range u.SSHPublicKeys {
 				cleanKey := soft.CleanKey(key)
-				if user, ok := keyToUser[cleanKey]; ok {
-					if u.Username != user {
-						panic("MUST NOT REACH! IMPOSSIBLE KEY USER RECORD")
+				if _, ok := existingPublicKeys[cleanKey]; !ok {
+					if err := s.client.AddPublicKey(u.Username, cleanKey); err != nil {
+						fmt.Println(err)
+						return
 					}
-					continue
-				}
-				if err := s.client.AddPublicKey(u.Username, cleanKey); err != nil {
-					fmt.Println(err)
-					return
 				}
 			}
 		}
@@ -1785,7 +1785,7 @@
 		}
 		for _, u := range users {
 			if err := s.client.AddReadWriteCollaborator(r, u.Username); err != nil {
-				fmt.Println(err)
+				fmt.Printf("%s %s\n", u.Username, err)
 				continue
 			}
 		}