diff --git a/core/installer/app.go b/core/installer/app.go
index c4604c8..e054964 100644
--- a/core/installer/app.go
+++ b/core/installer/app.go
@@ -734,8 +734,11 @@
 	if err != nil {
 		return EnvAppRendered{}, err
 	}
+	if dv == nil {
+		dv = map[string]any{}
+	}
 	mv := merge(dv.(map[string]any), values)
-	derived, err := deriveValues(mv, values, a.Schema(), networks, clusters, vpnKeyGen)
+	derived, err := deriveValues(mv, mv, a.Schema(), networks, clusters, vpnKeyGen)
 	if err != nil {
 		return EnvAppRendered{}, err
 	}
diff --git a/core/installer/derived.go b/core/installer/derived.go
index cf792ef..4030623 100644
--- a/core/installer/derived.go
+++ b/core/installer/derived.go
@@ -83,7 +83,7 @@
 		// TODO(gio): validate that it is map
 		v, ok := values.(map[string]any)[k]
 		// TODO(gio): if missing use default value
-		if !ok {
+		if !ok || v == nil {
 			if def.Kind() == KindSSHKey {
 				key, err := NewECDSASSHKeyPair("tmp")
 				if err != nil {
diff --git a/core/installer/dodo_app_test.go b/core/installer/dodo_app_test.go
index b2cca5d..ec78325 100644
--- a/core/installer/dodo_app_test.go
+++ b/core/installer/dodo_app_test.go
@@ -10,6 +10,12 @@
 )
 
 var exposed = `
+input: {
+  key: {
+    private: "asd"
+    public: "qwe"
+  }
+}
 service: [{
     name: "app"
 	type: "golang:1.20.0"
diff --git a/core/installer/schema.go b/core/installer/schema.go
index b48217f..2b150a6 100644
--- a/core/installer/schema.go
+++ b/core/installer/schema.go
@@ -376,7 +376,7 @@
 func ExtractDefaultValues(v cue.Value) (any, error) {
 	switch v.IncompleteKind() {
 	case cue.StringKind:
-		if d, ok := v.Default(); ok {
+		if d, ok := v.Default(); ok || d.IsConcrete() {
 			return d.String()
 		}
 	case cue.BoolKind:
@@ -399,8 +399,6 @@
 			return nil, nil
 		} else if isAuth(v) {
 			return nil, nil
-		} else if isSSHKey(v) {
-			return nil, nil
 		} else if isCluster(v) {
 			return nil, nil
 		}
@@ -414,7 +412,12 @@
 			if err != nil {
 				return nil, err
 			}
-			ret[f.Selector().String()] = fv
+			if fv != nil {
+				ret[f.Selector().String()] = fv
+			}
+		}
+		if len(ret) == 0 {
+			return nil, nil
 		}
 		return ret, nil
 	default: