diff --git a/CHANGES.md b/CHANGES.md
index c8a20f3a6a684102ed954c5aa27f2e16113df43f..9aaffefe83e121a1b5ab21a79d659be9d0950389 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -45,6 +45,12 @@
 - `Cli.Options.job_count` is now an `int option` instead of an `int`.
   Same for `~worker_count`.
   The latter only affects custom schedulers.
+## development version
+
+- when using a runner with ssh, and an ssh_id is provided, we now force ssh to
+  use this id only for authentication. Previous behaviour was that it also
+  looked at user's identity files.
+
 
 ## Version 4.2.0
 
diff --git a/lib/runner.ml b/lib/runner.ml
index f0f4eaaad523b5aa0220a4d0699dc9926c4c630b..ea5c47e760fcceb0ed1e84171a23815da58f375b 100644
--- a/lib/runner.ml
+++ b/lib/runner.ml
@@ -134,7 +134,10 @@ let wrap_with_ssh runner shell =
     @ (match runner.ssh_port with
       | None -> []
       | Some port -> ["-p"; string_of_int port])
-    @ match runner.ssh_id with None -> [] | Some id -> ["-i"; id]
+    @
+    match runner.ssh_id with
+    | None -> []
+    | Some id -> ["-o"; "IdentitiesOnly=yes"; "-i"; id]
   in
   ("ssh", runner.options @ ssh_args @ [cmd])