diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 8828429a817..0834fc67284 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -363,12 +363,9 @@ in
           HostKey ${k.path}
         '')}
 
-        # Allow DSA client keys for now. (These were deprecated
-        # in OpenSSH 7.0.)
-        PubkeyAcceptedKeyTypes +ssh-dss
-
-        # Re-enable DSA host keys for now.
         ${optionalString supportOldHostKeys ''
+          # Allow DSA keys for now. (deprecated in OpenSSH 7.0)
+          PubkeyAcceptedKeyTypes +ssh-dss
           HostKeyAlgorithms +ssh-dss
         ''}
       '';