diff --git a/ssh/test/sshcli_test.go b/ssh/test/sshcli_test.go
index 4537394..1bd4381 100644
--- a/ssh/test/sshcli_test.go
+++ b/ssh/test/sshcli_test.go
@@ -90,7 +90,8 @@ func TestSSHCLIAuth(t *testing.T) {
 	}
 
 	// test public key authentication.
-	cmd := testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
+	cmd := testenv.Command(t, sshCLI, "-F", "none", "-vvv", "-i", keyPrivPath,
+		"-o", "StrictHostKeyChecking=no", "-o", "IdentityAgent=none",
 		"-p", port, "testpubkey@127.0.0.1", "true")
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -99,7 +100,8 @@ func TestSSHCLIAuth(t *testing.T) {
 	// Test SSH user certificate authentication.
 	// The username must match one of the principals included in the certificate.
 	// The certificate "rsa-user-testcertificate" has "testcertificate" as principal.
-	cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
+	cmd = testenv.Command(t, sshCLI, "-F", "none", "-vvv", "-i", keyPrivPath,
+		"-o", "StrictHostKeyChecking=no", "-o", "IdentityAgent=none",
 		"-p", port, "testcertificate@127.0.0.1", "true")
 	out, err = cmd.CombinedOutput()
 	if err != nil {
@@ -121,7 +123,7 @@ func TestSSHCLIKeyExchanges(t *testing.T) {
 	keyExchanges := append(ssh.SupportedAlgorithms().KeyExchanges, ssh.InsecureAlgorithms().KeyExchanges...)
 	for _, kex := range keyExchanges {
 		t.Run(kex, func(t *testing.T) {
-			cmd := testenv.Command(t, sshCLI, "-Q", "kex")
+			cmd := testenv.Command(t, sshCLI, "-F", "none", "-Q", "kex")
 			out, err := cmd.CombinedOutput()
 			if err != nil {
 				t.Fatalf("%s failed to check if the KEX is supported, error: %v, command output %q", kex, err, string(out))
@@ -154,7 +156,8 @@ func TestSSHCLIKeyExchanges(t *testing.T) {
 				t.Fatalf("unable to get server port: %v", err)
 			}
 
-			cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
+			cmd = testenv.Command(t, sshCLI, "-F", "none", "-vvv", "-i", keyPrivPath,
+				"-o", "StrictHostKeyChecking=no", "-o", "IdentityAgent=none",
 				"-o", fmt.Sprintf("KexAlgorithms=%s", kex), "-p", port, "testpubkey@127.0.0.1", "true")
 			out, err = cmd.CombinedOutput()
 			if err != nil {