Run this on new Debian/Ubuntu nodes to persist custom SSH flags across APT updates.
curl -sSL https://nb.l0p.uk | sudo bash