diff --git a/roles/ssh_hardening/tasks/crypto_kex.yml b/roles/ssh_hardening/tasks/crypto_kex.yml
index 193236f2..1161d611 100644
--- a/roles/ssh_hardening/tasks/crypto_kex.yml
+++ b/roles/ssh_hardening/tasks/crypto_kex.yml
@@ -13,3 +13,8 @@
   set_fact:
     ssh_kex: '{{ ssh_kex_80_default }}'
   when: sshd_version is version('8.0', '>=')
+
+- name: Set kex according to openssh-version if openssh >= 8.5
+  set_fact:
+    ssh_kex: '{{ ssh_kex_85_default }}'
+  when: sshd_version is version('8.5', '>=')
diff --git a/roles/ssh_hardening/vars/main.yml b/roles/ssh_hardening/vars/main.yml
index 99b7004c..26e95f9a 100644
--- a/roles/ssh_hardening/vars/main.yml
+++ b/roles/ssh_hardening/vars/main.yml
@@ -50,3 +50,8 @@ ssh_kex_80_default:
   - sntrup4591761x25519-sha512@tinyssh.org
   - curve25519-sha256@libssh.org
   - diffie-hellman-group-exchange-sha256
+
+ssh_kex_85_default:
+  - sntrup761x25519-sha512@openssh.com
+  - curve25519-sha256@libssh.org
+  - diffie-hellman-group-exchange-sha256