diff --git a/modules/programs/ssh.nix b/modules/programs/ssh.nix
index f73da437..ed7185df 100644
--- a/modules/programs/ssh.nix
+++ b/modules/programs/ssh.nix
@@ -451,7 +451,13 @@ let
       ++ map (f: "  LocalForward" + addressPort f.bind + addressPort f.host) cf.localForwards
       ++ map (f: "  RemoteForward" + addressPort f.bind + addressPort f.host) cf.remoteForwards
       ++ map (f: "  DynamicForward" + addressPort f) cf.dynamicForwards
-      ++ mapAttrsToList (n: v: "  ${n} ${v}") cf.extraOptions
+      ++ [
+        (lib.generators.toKeyValue {
+          mkKeyValue = lib.generators.mkKeyValueDefault { } " ";
+          listsAsDuplicateKeys = true;
+          indent = "  ";
+        } cf.extraOptions)
+      ]
     );
 
 in
diff --git a/tests/modules/programs/ssh/forwards-dynamic-valid-bind-no-asserts-expected.conf b/tests/modules/programs/ssh/forwards-dynamic-valid-bind-no-asserts-expected.conf
index 1c4c4f86..fc7e4acf 100644
--- a/tests/modules/programs/ssh/forwards-dynamic-valid-bind-no-asserts-expected.conf
+++ b/tests/modules/programs/ssh/forwards-dynamic-valid-bind-no-asserts-expected.conf
@@ -1,7 +1,9 @@
 Host dynamicBindAddressWithPort
   DynamicForward [127.0.0.1]:3000
+
 Host dynamicBindPathNoPort
   DynamicForward /run/user/1000/gnupg/S.gpg-agent.extra
 
 
+
   
diff --git a/tests/modules/programs/ssh/match-blocks-attrs-expected.conf b/tests/modules/programs/ssh/match-blocks-attrs-expected.conf
index edff6264..7e488eb8 100644
--- a/tests/modules/programs/ssh/match-blocks-attrs-expected.conf
+++ b/tests/modules/programs/ssh/match-blocks-attrs-expected.conf
@@ -2,8 +2,10 @@ Host * !github.com
   Port 516
   IdentityFile file1
   IdentityFile file2
+
 Host abc
   ProxyJump jump-host
+
 Host xyz
   SetEnv BAR="_bar_ 42" FOO="foo12"
   ServerAliveInterval 60
@@ -13,8 +15,10 @@ Host xyz
   RemoteForward [localhost]:8081 [10.0.0.2]:80
   RemoteForward /run/user/1000/gnupg/S.gpg-agent.extra /run/user/1000/gnupg/S.gpg-agent
   DynamicForward [localhost]:2839
+
 Host ordered
   Port 1
 
 
+
   
diff --git a/tests/modules/programs/ssh/match-blocks-match-and-hosts-expected.conf b/tests/modules/programs/ssh/match-blocks-match-and-hosts-expected.conf
index b5f3dad8..6fb60b1e 100644
--- a/tests/modules/programs/ssh/match-blocks-match-and-hosts-expected.conf
+++ b/tests/modules/programs/ssh/match-blocks-match-and-hosts-expected.conf
@@ -1,9 +1,12 @@
 Host * !github.com
   Port 516
+
 Host abc
   Port 2222
+
 Match host xyz canonical
   Port 2223
 
 
+
   
diff --git a/tests/modules/programs/ssh/old-defaults-expected.conf b/tests/modules/programs/ssh/old-defaults-expected.conf
index 65290800..75a34ce4 100644
--- a/tests/modules/programs/ssh/old-defaults-expected.conf
+++ b/tests/modules/programs/ssh/old-defaults-expected.conf
@@ -11,4 +11,5 @@ Host *
   ControlMaster no
   ControlPath ~/.ssh/master-%r@%n:%p
   ControlPersist no
+
   
diff --git a/tests/modules/programs/ssh/old-defaults-extra-config-expected.conf b/tests/modules/programs/ssh/old-defaults-extra-config-expected.conf
index e14c44e8..46f398dd 100644
--- a/tests/modules/programs/ssh/old-defaults-extra-config-expected.conf
+++ b/tests/modules/programs/ssh/old-defaults-extra-config-expected.conf
@@ -11,6 +11,7 @@ Host *
   ControlMaster no
   ControlPath ~/.ssh/master-%r@%n:%p
   ControlPersist no
+
   MyExtraOption no
   AnotherOption 3
   
diff --git a/tests/modules/programs/ssh/renamed-options-expected.conf b/tests/modules/programs/ssh/renamed-options-expected.conf
index e586953c..f01bc02e 100644
--- a/tests/modules/programs/ssh/renamed-options-expected.conf
+++ b/tests/modules/programs/ssh/renamed-options-expected.conf
@@ -11,4 +11,5 @@ Host *
   ControlMaster yes
   ControlPath ~/.ssh/myfile-%r@%n:%p
   ControlPersist 10m
+