diff --git a/cloud/shepherd/provider/equinix/BUILD.bazel b/cloud/shepherd/provider/equinix/BUILD.bazel
index 23502b3..e0333b1 100644
--- a/cloud/shepherd/provider/equinix/BUILD.bazel
+++ b/cloud/shepherd/provider/equinix/BUILD.bazel
@@ -22,7 +22,6 @@
         "//cloud/lib/sinbin",
         "//cloud/shepherd",
         "//cloud/shepherd/manager",
-        "//go/net/ssh",
         "@com_github_packethost_packngo//:packngo",
         "@io_k8s_klog_v2//:klog",
         "@org_golang_x_crypto//ssh",
@@ -49,6 +48,7 @@
         "//cloud/shepherd/manager",
         "@com_github_google_uuid//:uuid",
         "@com_github_packethost_packngo//:packngo",
+        "@org_golang_x_crypto//ssh",
         "@org_golang_x_time//rate",
     ],
 )
diff --git a/cloud/shepherd/provider/equinix/initializer_test.go b/cloud/shepherd/provider/equinix/initializer_test.go
index 587b70a..fc34a10 100644
--- a/cloud/shepherd/provider/equinix/initializer_test.go
+++ b/cloud/shepherd/provider/equinix/initializer_test.go
@@ -12,6 +12,7 @@
 	"time"
 
 	"github.com/packethost/packngo"
+	"golang.org/x/crypto/ssh"
 	"golang.org/x/time/rate"
 
 	"source.monogon.dev/cloud/bmaas/bmdb"
@@ -51,14 +52,17 @@
 		ControlLoopConfig: manager.ControlLoopConfig{
 			DBQueryLimiter: rate.NewLimiter(rate.Every(time.Second), 10),
 		},
-		Executable:        []byte("beep boop i'm a real program"),
-		TargetPath:        "/fake/path",
-		Endpoint:          "example.com:1234",
-		SSHConnectTimeout: time.Second,
-		SSHExecTimeout:    time.Second,
+		Executable: []byte("beep boop i'm a real program"),
+		TargetPath: "/fake/path",
+		Endpoint:   "example.com:1234",
+		SSHConfig: ssh.ClientConfig{
+			Timeout: time.Second,
+		},
+		SSHExecTimeout: time.Second,
+		DialSSH:        manager.FakeSSHDial,
 	}
 
-	i, err := manager.NewInitializer(provider, &manager.FakeSSHClient{}, ic)
+	i, err := manager.NewInitializer(provider, ic)
 	if err != nil {
 		t.Fatalf("Could not create Initializer: %v", err)
 	}
diff --git a/cloud/shepherd/provider/equinix/main.go b/cloud/shepherd/provider/equinix/main.go
index 1322039..9903b04 100644
--- a/cloud/shepherd/provider/equinix/main.go
+++ b/cloud/shepherd/provider/equinix/main.go
@@ -11,7 +11,7 @@
 	"os"
 	"os/signal"
 
-	xssh "golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh"
 	"k8s.io/klog/v2"
 
 	"source.monogon.dev/cloud/bmaas/bmdb"
@@ -19,7 +19,6 @@
 	"source.monogon.dev/cloud/equinix/wrapngo"
 	"source.monogon.dev/cloud/lib/component"
 	"source.monogon.dev/cloud/shepherd/manager"
-	"source.monogon.dev/go/net/ssh"
 )
 
 type Config struct {
@@ -94,18 +93,19 @@
 		klog.Exitf("%v", err)
 	}
 
-	sshClient := &ssh.DirectClient{
-		AuthMethods: []xssh.AuthMethod{xssh.PublicKeys(sshSigner)},
-		// Equinix OS installations always use root.
-		Username: "root",
-	}
+	c.InitializerConfig.SSHConfig.Auth = []ssh.AuthMethod{ssh.PublicKeys(sshSigner)}
+	// Equinix OS installations always use root.
+	c.InitializerConfig.SSHConfig.User = "root"
+	// Ignore the host key, since it's likely the first time anything logs into
+	// this device, and also because there's no way of knowing its fingerprint.
+	c.InitializerConfig.SSHConfig.HostKeyCallback = ssh.InsecureIgnoreHostKey()
 
 	provisioner, err := manager.NewProvisioner(provider, c.ProvisionerConfig)
 	if err != nil {
 		klog.Exitf("%v", err)
 	}
 
-	initializer, err := manager.NewInitializer(provider, sshClient, c.InitializerConfig)
+	initializer, err := manager.NewInitializer(provider, c.InitializerConfig)
 	if err != nil {
 		klog.Exitf("%v", err)
 	}