diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 5afb07319a..4a22597ec6 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -743,10 +743,13 @@ function generate_random_name(?string $cuid = null): string
 
     return Str::kebab("{$generator->getName()}-$cuid");
 }
+/**
+ * RSA keys get 4096 bits: GitHub rejects new RSA SSH keys smaller than 3072 bits, and phpseclib makes 2048-bit keys by default.
+ */
 function generateSSHKey(string $type = 'rsa')
 {
     if ($type === 'rsa') {
-        $key = RSA::createKey();
+        $key = RSA::createKey(4096);
 
         return [
             'private' => $key->toString('PKCS1'),
diff --git a/tests/Unit/GenerateSshKeyTest.php b/tests/Unit/GenerateSshKeyTest.php
new file mode 100644
index 0000000000..526dc000fb
--- /dev/null
+++ b/tests/Unit/GenerateSshKeyTest.php
@@ -0,0 +1,15 @@
+<?php
+
+use phpseclib3\Crypt\PublicKeyLoader;
+use phpseclib3\Crypt\RSA;
+
+it('generates RSA keys that GitHub accepts (at least 3072 bits)', function () {
+    $keyPair = generateSSHKey('rsa');
+
+    $privateKey = PublicKeyLoader::load($keyPair['private']);
+    $publicKey = PublicKeyLoader::load($keyPair['public']);
+
+    expect($privateKey)->toBeInstanceOf(RSA\PrivateKey::class)
+        ->and($privateKey->getLength())->toBeGreaterThanOrEqual(3072)
+        ->and($publicKey->getLength())->toBe($privateKey->getLength());
+});