diff --git a/changelogs/unreleased/ssh_user.yml b/changelogs/unreleased/ssh_user.yml
new file mode 100644
index 0000000000000000000000000000000000000000..7a60c5a26dc3f1e252969a34bef007b48b1c3bfb_Y2hhbmdlbG9ncy91bnJlbGVhc2VkL3NzaF91c2VyLnltbA==
--- /dev/null
+++ b/changelogs/unreleased/ssh_user.yml
@@ -0,0 +1,5 @@
+---
+title: Expose ssh_user as a distinct configuration option
+merge_request: 3925
+author:
+type: added
diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
index 226745939e370998c583338184ab95facb5d6ee2_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..7a60c5a26dc3f1e252969a34bef007b48b1c3bfb_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -60,6 +60,7 @@
 ##! Docs: https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/gitlab.yml.md
 ################################################################################
 # gitlab_rails['gitlab_ssh_host'] = 'ssh.host_example.com'
+# gitlab_rails['gitlab_ssh_user'] = ''
 # gitlab_rails['time_zone'] = 'UTC'
 
 ### Request duration
diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb
index 226745939e370998c583338184ab95facb5d6ee2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..7a60c5a26dc3f1e252969a34bef007b48b1c3bfb_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644
--- a/files/gitlab-cookbooks/gitlab/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb
@@ -88,6 +88,7 @@
 default['gitlab']['gitlab-rails']['gitlab_host'] = node['fqdn']
 default['gitlab']['gitlab-rails']['gitlab_port'] = 80
 default['gitlab']['gitlab-rails']['gitlab_https'] = false
+default['gitlab']['gitlab-rails']['gitlab_ssh_user'] = nil
 default['gitlab']['gitlab-rails']['gitlab_ssh_host'] = nil
 default['gitlab']['gitlab-rails']['time_zone'] = nil
 default['gitlab']['gitlab-rails']['gitlab_email_from'] = nil
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb
index 226745939e370998c583338184ab95facb5d6ee2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLnltbC5lcmI=..7a60c5a26dc3f1e252969a34bef007b48b1c3bfb_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLnltbC5lcmI= 100644
--- a/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb
@@ -23,6 +23,10 @@
     # Otherwise, ssh host will be set to the `host:` value above
     ssh_host: <%= @gitlab_ssh_host %>
 
+    # If your ssh user differs from the system user, you need to specify it here
+    # Set it to an empty string to omit the username from any ssh url altogether
+    ssh_user: <%= quote(@gitlab_ssh_user) %>
+
     # WARNING: See config/application.rb under "Relative url support" for the list of
     # other files that need to be changed for relative url support
     relative_url_root: <%= @gitlab_relative_url %>