diff --git a/tasks/configure_ssh_hardening.yml b/tasks/configure_ssh_hardening.yml
index ef041e7ccfc6d310394d04beacd0e6d87997877d..ecb69332f4c6f2d9572f650077c3ed33dd84c234 100644
--- a/tasks/configure_ssh_hardening.yml
+++ b/tasks/configure_ssh_hardening.yml
@@ -56,6 +56,9 @@
       KexAlgorithms diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org
       # disable weak Ciphers (crypto algorithms)
       # NVT OID: 1.3.6.1.4.1.25623.1.0.105611
-      Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
+      # Also explicitely disable ChaCha ciphers for "Terrapin" (CVE-2023-48795)
+      Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,-chacha20-poly1305@openssh.com
+      # Explicitely disable -ETM MACs for "Terrapin" (CVE-2023-48795)
+      MACs hmac-sha2-512,hmac-sha2-256,-*etm@openssh.com
   notify:
     - restart sshd