diff --git a/pkg/zones/zone_rings.go b/pkg/zones/zone_rings.go
index bde3b7a..4bd2e3b 100644
--- a/pkg/zones/zone_rings.go
+++ b/pkg/zones/zone_rings.go
@@ -1,5 +1,7 @@
 package zones
 
+import "os"
+
 // PruneWireguardConfig removes wgN.conf files of machines with
 // the corresponding ring disabled.
 func (z *Zone) PruneWireguardConfig(ring int) error {
@@ -16,6 +18,23 @@ func (z *Zone) PruneWireguardConfig(ring int) error {
 	return err
 }
 
+// WriteWireguardKeys rewrites all wgN.{key,pub} files on this zone
+func (z *Zone) WriteWireguardKeys(ring int) error {
+	var err error
+
+	z.ForEachMachine(func(p *Machine) bool {
+		err = p.WriteWireguardKeys(ring)
+		if os.IsNotExist(err) {
+			// ignore
+			err = nil
+		}
+
+		return err != nil
+	})
+
+	return err
+}
+
 // PruneWireguardConfig removes wgN.conf files of machines with
 // the corresponding ring disabled on all zones
 func (m *Zones) PruneWireguardConfig(ring int) error {
@@ -28,3 +47,15 @@ func (m *Zones) PruneWireguardConfig(ring int) error {
 
 	return err
 }
+
+// WriteWireguardKeys rewrites all wgN.{key,pub} files
+func (m *Zones) WriteWireguardKeys(ring int) error {
+	var err error
+
+	m.ForEachZone(func(z *Zone) bool {
+		err = z.WriteWireguardKeys(ring)
+		return err != nil
+	})
+
+	return err
+}