diff --git a/README.md b/README.md
index 82e288c2976655e7050827f464a412f2255e728a..797b494e823ea4e09a32b1581a65dcb9b98d3835 100644
--- a/README.md
+++ b/README.md
@@ -80,6 +80,7 @@ It usually should not differ between deployments and might be assigned to many m
 
 - `deploy.config.key` **no default value**
   A private key that is able to access repositories.
+  **Deprecated** Use [gitlab deploy tokens](https://doc.it.hs-hannover.de/books/sysadmin/page/gitlab-deploy-with-token-and-without-ssh) instead:
 - `deploy.config.deploy_directory` _default: `/srv/repo`_
   The directory in which git clones are located.
 - `deploy.config.venv_directory` _default: `/srv/venv`_
diff --git a/deploy/user.sls b/deploy/user.sls
index 6289b41b56d75ad593b88163c8ad37a92e550e5a..611a44b8ae72e5e10bc0fd62497c99a24bd48d43 100644
--- a/deploy/user.sls
+++ b/deploy/user.sls
@@ -4,6 +4,7 @@ deployer:
   user.absent: []
   group.absent: []
 
+{% if salt.pillar.get('deploy:config:key:', None) is not None %}
 
 deploy_user_ssh_known_hosts_file_present:
   file.managed:
@@ -50,6 +51,8 @@ deploy_key:
     - group: root
     - makedirs: True
 
+{% endif %}
+
 {% for project_name, project_config in deploy.projects.items() %}
 
 {% set config_user_groups = project_config.get('user_groups', []) %}