diff --git a/cmd/cashier/client_test.go b/cmd/cashier/client_test.go
index f0176c682ee381e1fcac37f793ab9c617ad1106c..b82d78fe865dce6be6d96e06ca0c2ed997b9e16a 100644
--- a/cmd/cashier/client_test.go
+++ b/cmd/cashier/client_test.go
@@ -40,8 +40,8 @@ func TestLoadCert(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error reading from agent: %v", err)
 	}
-	if len(listedKeys) != 1 {
-		t.Fatalf("Expected 1 key, got %d", len(listedKeys))
+	if len(listedKeys) != 2 {
+		t.Fatalf("Expected 2 keys, got %d", len(listedKeys))
 	}
 	if !bytes.Equal(listedKeys[0].Marshal(), c.Marshal()) {
 		t.Fatal("Certs not equal")
diff --git a/cmd/cashier/main.go b/cmd/cashier/main.go
index a9c509fd050555ba42c9daceb3d9948403b2a1fb..047c13e24d96f786b8463f3e1517cca2acbf782d 100644
--- a/cmd/cashier/main.go
+++ b/cmd/cashier/main.go
@@ -42,6 +42,14 @@ func installCert(a agent.Agent, cert *ssh.Certificate, key key) error {
 	if err := a.Add(pubcert); err != nil {
 		return fmt.Errorf("error importing certificate: %s", err)
 	}
+	privkey := agent.AddedKey{
+		PrivateKey:   key,
+		Comment:      cert.KeyId,
+		LifetimeSecs: uint32(lifetime),
+	}
+	if err := a.Add(privkey); err != nil {
+		return fmt.Errorf("error importing key: %s", err)
+	}
 	return nil
 }
 
@@ -147,5 +155,5 @@ func main() {
 	if err := installCert(a, cert, priv); err != nil {
 		log.Fatalln(err)
 	}
-	fmt.Println("Certificate added.")
+	fmt.Println("Credentials added.")
 }