diff --git a/ChangeLog b/ChangeLog
index 347a876ea..e6d0ce878 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+20030628
+ - (dtucker) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2003/06/23 09:02:44
+     [ssh_config.5]
+     document EnableSSHKeysign; bugzilla #599; ok deraadt@, jmc@
+
 20030624
  - (dtucker) Have configure refer the user to config.log and
    contrib/findssl.sh for OpenSSL header/library mismatches.
@@ -583,4 +589,4 @@
  - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
    Report from murple@murple.net, diagnosis from dtucker@zip.com.au
 
-$Id: ChangeLog,v 1.2823 2003/06/24 10:22:09 dtucker Exp $
+$Id: ChangeLog,v 1.2824 2003/06/28 02:33:12 dtucker Exp $
diff --git a/ssh_config.5 b/ssh_config.5
index 85a686b08..56df3acec 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.13 2003/06/10 09:12:12 jmc Exp $
+.\" $OpenBSD: ssh_config.5,v 1.14 2003/06/23 09:02:44 markus Exp $
 .Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os
@@ -252,6 +252,24 @@ will act as a SOCKS4 server.
 Multiple forwardings may be specified, and
 additional forwardings can be given on the command line.
 Only the superuser can forward privileged ports.
+.It Cm EnableSSHKeysign
+Setting this option to
+.Dq yes
+in the global client configuration file
+.Pa /etc/ssh/ssh_config
+enables the use of the helper program
+.Xr ssh-keysign 8
+during
+.Cm HostbasedAuthentication .
+The argument must be
+.Dq yes
+or
+.Dq no .
+The default is
+.Dq no .
+See
+.Xr ssh-keysign 8
+for more information.
 .It Cm EscapeChar
 Sets the escape character (default:
 .Ql ~ ) .