diff --git a/modules/ssh-client/cmd/ssh-client-tools/templates_test.go b/modules/ssh-client/cmd/ssh-client-tools/templates_test.go
index 7d0718b5..dd06a356 100644
--- a/modules/ssh-client/cmd/ssh-client-tools/templates_test.go
+++ b/modules/ssh-client/cmd/ssh-client-tools/templates_test.go
@@ -62,3 +62,29 @@ func TestEveryFileTakesItsTextFromATemplate(t *testing.T) {
 		t.Errorf("the build packs files/ into %d archives, not one", packs)
 	}
 }
+
+// Issue 955, area S2: the module keeps the keys state and requires the forge's account provision. It declares
+// no provision `ssh-key`: the state serves the public half (novox/hq ADR 0400 §1).
+func TestManifestKeepsKeysAndRequiresForgeAccount(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join(moduleDir, "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		State    []string `json:"state"`
+		Requires []any    `json:"requires"`
+		Provides []any    `json:"provides"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	if len(m.State) != 1 || m.State[0] != "keys" {
+		t.Errorf("state = %v, want [keys]", m.State)
+	}
+	if len(m.Requires) != 1 || m.Requires[0] != "forge-account" {
+		t.Errorf("requires = %v, want [forge-account]", m.Requires)
+	}
+	if len(m.Provides) != 0 {
+		t.Errorf("provides = %v, want none (no ssh-key provision yet)", m.Provides)
+	}
+}
diff --git a/modules/ssh-client/module.json b/modules/ssh-client/module.json
index 5bc3c2e2..126486a5 100644
--- a/modules/ssh-client/module.json
+++ b/modules/ssh-client/module.json
@@ -11,6 +11,12 @@
     "ssh_client_known_host",
     "ssh_client_test"
   ],
+  "requires": [
+    "forge-account"
+  ],
+  "state": [
+    "keys"
+  ],
   "data": {
     "own": [
       {