diff --git a/scripts/Invoke-CIJob.ps1 b/scripts/Invoke-CIJob.ps1
index a2c1b07..c8f3925 100644
--- a/scripts/Invoke-CIJob.ps1
+++ b/scripts/Invoke-CIJob.ps1
@@ -438,6 +438,20 @@ try {
             Write-Host "[Invoke-CIJob] Could not detect GuestOS from VMX — defaulting to Windows"
         }
     }
+    # ── Purge stale known_hosts entry for this IP (Linux only) ───────────
+    # Each clone gets a new SSH host key. Remove any previous entry for this
+    # IP from the CI-local known_hosts file before the first SSH connection,
+    # so ssh.exe uses accept-new instead of refusing a changed key.
+    if ($GuestOS -eq 'Linux' -and $SshKnownHostsFile -ne '') {
+        $khDir = Split-Path $SshKnownHostsFile -Parent
+        if (-not (Test-Path $khDir)) {
+            New-Item -ItemType Directory -Path $khDir -Force | Out-Null
+        }
+        if (Test-Path $SshKnownHostsFile) {
+            & ssh-keygen -R $VMIPAddress -f $SshKnownHostsFile 2>$null | Out-Null
+            Write-Host "[Invoke-CIJob] Purged known_hosts entry for $VMIPAddress (fresh clone)."
+        }
+    }
     # ── Phase 4: Wait for readiness ───────────────────────────────────────
     Write-Host "`n[Phase 4/6] Waiting for VM readiness..."
     Write-JobEvent -Phase 'phase4.wait-ready' -Status 'start' -Data @{ ip = $VMIPAddress }