diff --git a/README.md b/README.md
index 1c332ef..ffcb953 100644
--- a/README.md
+++ b/README.md
@@ -52,7 +52,7 @@ All parameters are optional in the raw schema except `host` and `username` — t
 
 #### Validation rules enforced by the service
 
-- Either `password` or `key_file` must be provided
+- Either `password` or `key_file` must be provided, but not both
 - Either `command` or `input` or both must be provided
 - If `key_file` is provided, the file must exist on the Home Assistant filesystem
 - `known_hosts` may not be provided when `check_known_hosts` is `false`
diff --git a/__init__.py b/__init__.py
index 2477a24..453b60c 100644
--- a/__init__.py
+++ b/__init__.py
@@ -31,6 +31,13 @@ async def _validate_service_data(hass: HomeAssistant, data: dict[str, Any]) -> N
             translation_key="password_or_key_file_required",
         )
 
+    if has_password and has_key_file:
+        raise ServiceValidationError(
+            "Password and key file cannot both be provided.",
+            translation_domain=DOMAIN,
+            translation_key="password_and_key_file",
+        )
+
     has_command: bool = bool(data.get(CONF_COMMAND))
     has_input: bool = bool(data.get(CONF_INPUT))
 
diff --git a/strings.json b/strings.json
index 99519a8..964cf44 100644
--- a/strings.json
+++ b/strings.json
@@ -53,6 +53,9 @@
     "password_or_key_file_required": {
       "message": "Either password or key file must be provided."
     },
+    "password_and_key_file": {
+      "message": "Password and key file cannot both be provided."
+    },
     "command_or_input": {
       "message": "Either command or input must be provided."
     },
diff --git a/tests/unit_tests/test_validate_service_data.py b/tests/unit_tests/test_validate_service_data.py
index caecf09..4e5b443 100644
--- a/tests/unit_tests/test_validate_service_data.py
+++ b/tests/unit_tests/test_validate_service_data.py
@@ -29,6 +29,11 @@ async def test_no_password_no_key_file_raises(self):
             await _validate_service_data(self.mock_hass, {"command": "echo hi"})
         self.assertEqual(ctx.exception.translation_key, "password_or_key_file_required")
 
+    async def test_password_and_key_file_raises(self):
+        with self.assertRaises(ServiceValidationError) as ctx:
+            await _validate_service_data(self.mock_hass, {"password": "secret", "key_file": "/home/user/.ssh/id_rsa", "command": "echo hi"})
+        self.assertEqual(ctx.exception.translation_key, "password_and_key_file")
+
     async def test_no_command_no_input_raises(self):
         with self.assertRaises(ServiceValidationError) as ctx:
             await _validate_service_data(self.mock_hass, {"password": "secret"})
diff --git a/translations/de.json b/translations/de.json
index 3c4e4c3..5e8aae8 100644
--- a/translations/de.json
+++ b/translations/de.json
@@ -49,6 +49,9 @@
     "password_or_key_file_required": {
       "message": "Entweder Passwort oder Schlüsseldatei muss angegeben werden."
     },
+    "password_and_key_file": {
+      "message": "Passwort und Schlüsseldatei können nicht gleichzeitig angegeben werden."
+    },
     "command_or_input": {
       "message": "Entweder Befehl oder Eingabe muss angegeben werden."
     },
diff --git a/translations/en.json b/translations/en.json
index 844b406..944ffb2 100644
--- a/translations/en.json
+++ b/translations/en.json
@@ -49,6 +49,9 @@
     "password_or_key_file_required": {
       "message": "Either password or key file must be provided."
     },
+    "password_and_key_file": {
+      "message": "Password and key file cannot both be provided."
+    },
     "command_or_input": {
       "message": "Either command or input must be provided."
     },