diff --git a/completions/ssh-keygen b/completions/ssh-keygen
index f8275d4a5c2..838be242e7e 100644
--- a/completions/ssh-keygen
+++ b/completions/ssh-keygen
@@ -66,11 +66,12 @@ _ssh_keygen()
                     no-x11-forwarding permit-agent-forwarding
                     permit-port-forwarding permit-pty permit-user-rc
                     permit-X11-forwarding no-touch-required source-address=
+                    verify-required
 
                     lines= start-line= checkpoint= memory= start= generator=
 
-                    application challenge= device resident user
-                    write-attestation-path
+                    application= challenge= device= no-touch-required resident
+                    user= write-attestation=
                     ' -- "$cur"))
                 [[ ${COMPREPLY-} == *[:=] ]] && compopt -o nospace
                 __ltrim_colon_completions "$cur"
@@ -80,10 +81,17 @@ _ssh_keygen()
                         compopt -o filenames
                         COMPREPLY=($(compgen -c -- "${cur#*=}"))
                         ;;
-                    checkpoint=* | challenge=*)
+                    checkpoint=* | challenge=* | write-attestation=*)
                         cur=${cur#*=}
                         _filedir
                         ;;
+                    application=*([^:=]))
+                        COMPREPLY=($(compgen -W "ssh:" -- "${cur#*=}"))
+                        compopt -o nospace
+                        ;;
+                    user=*)
+                        COMPREPLY=($(compgen -u -- "${cur#*=}"))
+                        ;;
                 esac
             fi
             return
diff --git a/test/t/test_ssh_keygen.py b/test/t/test_ssh_keygen.py
index 71551aa06ca..5c8adabba3a 100644
--- a/test/t/test_ssh_keygen.py
+++ b/test/t/test_ssh_keygen.py
@@ -69,3 +69,19 @@ def test_O_force_command(self, completion):
     @pytest.mark.complete("ssh-keygen -O unknown=")
     def test_O_unknown(self, completion):
         assert not completion
+
+    @pytest.mark.complete("ssh-keygen -O application=")
+    def test_O_application(self, completion):
+        assert completion == "ssh:"
+
+    @pytest.mark.complete("ssh-keygen -O application=s")
+    def test_O_application_s(self, completion):
+        assert completion == "sh:"
+
+    @pytest.mark.complete("ssh-keygen -O application=ssh:")
+    def test_O_application_ssh_colon(self, completion):
+        assert not completion
+
+    @pytest.mark.complete("ssh-keygen -O application=nonexistent")
+    def test_O_application_nonexistent(self, completion):
+        assert not completion