diff --git a/openappstack/ansible.py b/openappstack/ansible.py
index 4bcdef22968622304f103db612b50789ec58097e..aa2f9b0b90c5c57f356a8eabc3c9588366544816 100644
--- a/openappstack/ansible.py
+++ b/openappstack/ansible.py
@@ -22,6 +22,8 @@ def run_ansible(clus, playbook, ansible_params=None, no_host_key_checking=False)
         params.  Each inner list may only contain one element. Can be directly
         forwarded from argparse. Example:
         `ansible_params = [[become-user=root], [verbose]]`
+    :param bool no_host_key_checking: turns off "strict host key checking" on
+        the SSH connection (NOTE: UNSAFE!)
     """
     # playbook path here is relative to private_data_dir/project, see
     # https://ansible-runner.readthedocs.io/en/latest/intro.html#inputdir
@@ -35,8 +37,9 @@ def run_ansible(clus, playbook, ansible_params=None, no_host_key_checking=False)
             param = param[0]
             ansible_playbook_command.append(' --' + param)
     if no_host_key_checking:
-        ansible_playbook_command += ['-o', 'StrictHostKeyChecking=no', '-o',
-                                     'UserKnownHostsFile=/dev/null']
+        ansible_playbook_command += [
+            '--ssh-extra-args',
+            '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null']
 
     ansible_playbook_command += \
         ['-i', clus.inventory_file, '-e', '@' + clus.settings_file, playbook]