diff --git a/releasenotes/notes/fix-ssh-add-args-5819aedbaa127c15.yaml b/releasenotes/notes/fix-ssh-add-args-5819aedbaa127c15.yaml
new file mode 100644
index 0000000000..d6c5c24e58
--- /dev/null
+++ b/releasenotes/notes/fix-ssh-add-args-5819aedbaa127c15.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Untrusted playbooks no longer see
+    'Adding hosts ssh with ansible_user to the inventory is prohibited' when
+    using the add_host Ansible task on localhost.
diff --git a/tests/fixtures/config/ansible/git/org_project/.zuul.yaml b/tests/fixtures/config/ansible/git/org_project/.zuul.yaml
index 0abba34f64..a1d0d0281c 100644
--- a/tests/fixtures/config/ansible/git/org_project/.zuul.yaml
+++ b/tests/fixtures/config/ansible/git/org_project/.zuul.yaml
@@ -1,3 +1,7 @@
+- job:
+    name: add-host
+    run: playbooks/add-host.yaml
+
 - job:
     parent: python27
     name: faillocal
@@ -12,6 +16,7 @@
     name: org/project
     check:
       jobs:
+        - add-host
         - python27
         - faillocal
         - check-vars
diff --git a/tests/fixtures/config/ansible/git/org_project/playbooks/add-host.yaml b/tests/fixtures/config/ansible/git/org_project/playbooks/add-host.yaml
new file mode 100644
index 0000000000..33e9a6e682
--- /dev/null
+++ b/tests/fixtures/config/ansible/git/org_project/playbooks/add-host.yaml
@@ -0,0 +1,10 @@
+- hosts: all
+  tasks:
+    - name: Add fake host to inventory
+      add_host:
+        name: fake
+        ansible_connection: ssh
+        ansible_host: fake.example.org
+        ansible_port: 22
+        ansible_user: zuul
+        ansible_password: passw0rd1
diff --git a/tests/unit/test_v3.py b/tests/unit/test_v3.py
index d390d7aa4a..b793325680 100644
--- a/tests/unit/test_v3.py
+++ b/tests/unit/test_v3.py
@@ -2238,6 +2238,9 @@ class TestAnsible(AnsibleZuulTestCase):
         build_hello = self.getJobFromHistory('hello-world')
         with self.jobLog(build_hello):
             self.assertEqual(build_hello.result, 'SUCCESS')
+        build_add_host = self.getJobFromHistory('add-host')
+        with self.jobLog(build_add_host):
+            self.assertEqual(build_add_host.result, 'SUCCESS')
         build_python27 = self.getJobFromHistory('python27')
         with self.jobLog(build_python27):
             self.assertEqual(build_python27.result, 'SUCCESS')
diff --git a/zuul/ansible/action/add_host.py b/zuul/ansible/action/add_host.py
index 982c8085c2..28e74b155b 100644
--- a/zuul/ansible/action/add_host.py
+++ b/zuul/ansible/action/add_host.py
@@ -24,10 +24,10 @@ class ActionModule(add_host.ActionModule):
             'ansible_connection',
             'ansible_host',
             'ansible_port',
-            'ansible_user'
+            'ansible_user',
             'ansible_password',
             'ansible_ssh_host',
-            'ansible_ssh_port'
+            'ansible_ssh_port',
             'ansible_ssh_user',
             'ansible_ssh_pass',
         ))