diff --git a/ssh/agent/keyring.go b/ssh/agent/keyring.go
index d129875..75328bb 100644
--- a/ssh/agent/keyring.go
+++ b/ssh/agent/keyring.go
@@ -143,15 +143,21 @@ func (r *keyring) List() ([]*Key, error) {
 	return ids, nil
 }
 
-// Insert adds a private key to the keyring. If a certificate
-// is given, that certificate is added as public key. Note that
-// any constraints given are ignored.
+// Add adds a private key to the keyring. If a certificate is given, that
+// certificate is added as public key.
+//
+// Add returns an error if key contains ConstraintExtensions.
 func (r *keyring) Add(key AddedKey) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	if r.locked {
 		return errLocked
 	}
+
+	if len(key.ConstraintExtensions) > 0 {
+		return errors.New("agent: constraint extensions are present but not supported")
+	}
+
 	signer, err := ssh.NewSignerFromKey(key.PrivateKey)
 
 	if err != nil {
diff --git a/ssh/agent/keyring_test.go b/ssh/agent/keyring_test.go
index 5e495d5..6c08252 100644
--- a/ssh/agent/keyring_test.go
+++ b/ssh/agent/keyring_test.go
@@ -120,3 +120,27 @@ func TestAddDuplicateKey(t *testing.T) {
 		t.Fatal("key with the updated comment not found")
 	}
 }
+
+func TestAddKeyWithConstraints(t *testing.T) {
+	// Verifies the keyring refuses keys carrying constraint extensions it
+	// cannot enforce.
+	agent, cleanup := startKeyringAgent(t)
+	defer cleanup()
+
+	constraints := []ConstraintExtension{
+		{
+			ExtensionName:    "extension1",
+			ExtensionDetails: []byte("details1"),
+		},
+	}
+
+	key := testPrivateKeys["rsa"]
+
+	err := agent.Add(AddedKey{
+		PrivateKey:           key,
+		ConstraintExtensions: constraints,
+	})
+	if err == nil {
+		t.Fatal("adding a key with unsupported constraints succeeded")
+	}
+}