diff --git a/src/ssh/session-test-server.ts b/src/ssh/session-test-server.ts
index 366ad4c..95c6c90 100644
--- a/src/ssh/session-test-server.ts
+++ b/src/ssh/session-test-server.ts
@@ -81,10 +81,22 @@ export interface RunningTestServer {
   forceClose(): Promise<void>;
 }
 
-/** Generate a fresh ed25519 keypair in OpenSSH format (parseable by ssh2 both sides). */
+/**
+ * Generate a fresh ed25519 keypair in OpenSSH format (parseable by ssh2 both sides).
+ * ssh2's ed25519 generation has a ~0.4% chance of producing a key that it cannot parse;
+ * this function validates and retries up to 10 times to avoid the flake.
+ */
 export function generateEd25519Pair(): { privatePem: string; publicSsh: string } {
-  const kp = sshUtils.generateKeyPairSync('ed25519');
-  return { privatePem: kp.private, publicSsh: kp.public };
+  let lastError: Error | null = null;
+  for (let attempt = 0; attempt < 10; attempt++) {
+    const kp = sshUtils.generateKeyPairSync('ed25519');
+    const parsed = sshUtils.parseKey(kp.private);
+    if (!(parsed instanceof Error)) {
+      return { privatePem: kp.private, publicSsh: kp.public };
+    }
+    lastError = parsed;
+  }
+  throw lastError || new Error('Failed to generate valid ed25519 keypair after 10 attempts');
 }
 
 /** Generate an RSA-2048 PKCS#1 PEM keypair (parseable by ssh2.utils.parseKey). */