diff --git a/CHANGELOG.md b/CHANGELOG.md
index 95939dcb..7e470ddc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Simpler permissions in official RPM packages. #1696
 - Only calculate image chroot size when requested. #1504
 - Create temporary files in overlay directory during `wwctl overlay edit`. #1473
+- Re-order SSH key types to make ed25519 default. #981
 
 ### Fixed
 
diff --git a/etc/warewulf.conf b/etc/warewulf.conf
index 740b2e7b..32b05426 100644
--- a/etc/warewulf.conf
+++ b/etc/warewulf.conf
@@ -33,7 +33,7 @@ image mounts:
     readonly: true
 ssh:
   key types:
+    - ed25519
+    - ecdsa
     - rsa
     - dsa
-    - ecdsa
-    - ed25519
diff --git a/internal/pkg/config/ssh.go b/internal/pkg/config/ssh.go
index 5e08aac7..5acb257c 100644
--- a/internal/pkg/config/ssh.go
+++ b/internal/pkg/config/ssh.go
@@ -1,5 +1,5 @@
 package config
 
 type SSHConf struct {
-	KeyTypes []string `yaml:"key types,omitempty" default:"[\"rsa\",\"dsa\",\"ecdsa\",\"ed25519\"]"`
+	KeyTypes []string `yaml:"key types,omitempty" default:"[\"ed25519\",\"ecdsa\",\"rsa\",\"dsa\"]"`
 }
diff --git a/internal/pkg/configure/ssh.go b/internal/pkg/configure/ssh.go
index 681a7ab8..f8fa0771 100644
--- a/internal/pkg/configure/ssh.go
+++ b/internal/pkg/configure/ssh.go
@@ -6,6 +6,7 @@ import (
 	"path"
 
 	warewulfconf "github.com/warewulf/warewulf/internal/pkg/config"
+	"github.com/warewulf/warewulf/internal/pkg/overlay"
 	"github.com/warewulf/warewulf/internal/pkg/util"
 	"github.com/warewulf/warewulf/internal/pkg/wwlog"
 )
@@ -18,6 +19,15 @@ func SSH(keyTypes ...string) error {
 	if os.Getuid() == 0 {
 		fmt.Printf("Updating system keys\n")
 		conf := warewulfconf.Get()
+
+		if conf.Warewulf.EnableHostOverlay() {
+			if err := overlay.BuildHostOverlay(); err != nil {
+				wwlog.Warn("host overlay could not be built: %s", err)
+			}
+		} else {
+			wwlog.Info("host overlays are disabled")
+		}
+
 		wwkeydir := path.Join(conf.Paths.Sysconfdir, "warewulf/keys") + "/"
 
 		err := os.MkdirAll(path.Join(conf.Paths.Sysconfdir, "warewulf/keys"), 0755)
diff --git a/overlays/debug/internal/debug_test.go b/overlays/debug/internal/debug_test.go
index 5c4d3da9..15b4580f 100644
--- a/overlays/debug/internal/debug_test.go
+++ b/overlays/debug/internal/debug_test.go
@@ -109,11 +109,11 @@ data from other structures.
 
 ### SSH
 - Key types:
+  - ed25519
+  - ecdsa
   - rsa
   - dsa
-  - ecdsa
-  - ed25519
-- First key type: rsa
+- First key type: ed25519
 
 ## Node
 
diff --git a/overlays/host/internal/host_test.go b/overlays/host/internal/host_test.go
index ef4f4b08..c1c13a83 100644
--- a/overlays/host/internal/host_test.go
+++ b/overlays/host/internal/host_test.go
@@ -313,7 +313,7 @@ Filename: etc/profile.d/ssh_setup.csh
 if ( ( $_UID > 500 || $_UID == 0 ) && ( ! -f "$HOME/.ssh/config" && ! -f "$HOME/.ssh/cluster" ) ) then
     echo "Configuring SSH for cluster access"
     install -d -m 700 $HOME/.ssh
-    ssh-keygen -t rsa -f $HOME/.ssh/cluster -N '' -C "Warewulf Cluster key" >& /dev/null
+    ssh-keygen -t ed25519 -f $HOME/.ssh/cluster -N '' -C "Warewulf Cluster key" >& /dev/null
     cat $HOME/.ssh/cluster.pub >>! $HOME/.ssh/authorized_keys
     chmod 0600 $HOME/.ssh/authorized_keys
 
@@ -347,7 +347,7 @@ Filename: etc/profile.d/ssh_setup.sh
 if [ $_UID -ge 500 -o $_UID -eq 0 ] && [ ! -f "$HOME/.ssh/config" -a ! -f "$HOME/.ssh/cluster" ]; then
     echo "Configuring SSH for cluster access"
     install -d -m 700 $HOME/.ssh
-    ssh-keygen -t rsa -f $HOME/.ssh/cluster -N '' -C "Warewulf Cluster key" > /dev/null 2>&1
+    ssh-keygen -t ed25519 -f $HOME/.ssh/cluster -N '' -C "Warewulf Cluster key" > /dev/null 2>&1
     cat $HOME/.ssh/cluster.pub >> $HOME/.ssh/authorized_keys
     chmod 0600 $HOME/.ssh/authorized_keys
 
diff --git a/userdocs/contents/configuration.rst b/userdocs/contents/configuration.rst
index a8a721b4..6bc7e90d 100644
--- a/userdocs/contents/configuration.rst
+++ b/userdocs/contents/configuration.rst
@@ -46,10 +46,10 @@ Warewulf (4.6.0):
        readonly: true
    ssh:
      key types:
+       - ed25519
+       - ecdsa
        - rsa
        - dsa
-       - ecdsa
-       - ed25519
    wwclient:
      port: 0
 
@@ -165,10 +165,10 @@ SSH key types to generate during ``wwctl configure ssh`` may be overridden using
 
    ssh:
      key types:
+       - ed25519
+       - ecdsa
        - rsa
        - dsa
-       - ecdsa
-       - ed25519
 
 Warewulf will generate host keys for each listed key type.
 The first listed key type is used to generate authentication ssh keys.