diff --git a/ansible/roles/debian/tasks/main.yml b/ansible/roles/debian/tasks/main.yml
index f3f149f..a6ee7ac 100644
--- a/ansible/roles/debian/tasks/main.yml
+++ b/ansible/roles/debian/tasks/main.yml
@@ -59,3 +59,11 @@
     line: "AddressFamily any"
     state: present
   notify: restart ssh
+
+- name: "Comment out GSSAPIAuthentication in ssh_config (removed in OpenSSH 10)"
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/ssh_config
+    regexp: '^(?!\s*#)\s*GSSAPIAuthentication\s'
+    line: '#GSSAPIAuthentication yes'
+    state: present
+  when: ansible_facts['distribution_release'] == 'trixie'