diff --git a/roles/ssh_hardening/defaults/main.yml b/roles/ssh_hardening/defaults/main.yml
index 7d370395..9762ce42 100644
--- a/roles/ssh_hardening/defaults/main.yml
+++ b/roles/ssh_hardening/defaults/main.yml
@@ -91,9 +91,12 @@ ssh_use_pam: true                   # sshd
 # specify AuthenticationMethods
 sshd_authenticationmethods: 'publickey'
 
-# true if SSH support GSSAPI
+# Set to true to enable GSSAPI authentication (both client and server)
 ssh_gssapi_support: false
 
+# Set to true to enable GSSAPI credential forwarding
+ssh_gssapi_delegation: false
+
 # if specified, login is disallowed for user names that match one of the patterns.
 ssh_deny_users: ''                  # sshd