diff --git a/CHANGELOG.md b/CHANGELOG.md
index 185efb49..ff624daf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ The **patch** part changes incrementally at each release.
 ## [Unreleased]
 
 ### Added
+* evolinux-base: default value for "evolinux_ssh_group"
 
 ### Changed
 * elasticsearch: listen on local interface only by default
diff --git a/evolinux-base/defaults/main.yml b/evolinux-base/defaults/main.yml
index d4dc13d7..3ffb7040 100644
--- a/evolinux-base/defaults/main.yml
+++ b/evolinux-base/defaults/main.yml
@@ -123,6 +123,7 @@ evolinux_ssh_password_auth_addresses: "{{ evolinux_default_ssh_password_auth_add
 evolinux_ssh_match_address: True
 evolinux_ssh_disable_acceptenv: True
 evolinux_ssh_allow_current_user: False
+evolinux_ssh_group: "evolinux-ssh"
 
 ### disabled because of a memory leak
 # # evolinux users