Security: disable PasswordAuthentication for ssh

I’ve just set up a shiny new RancherOS box and I’m trying to reduce the attack surface area as much as possible. Does anyone here know how to persistently disable PasswordAuthentication for ssh?