Could not disable ssh-rsa in gitlab-ssh

I am trying to disable ssh-rsa algorithm for public key in gitlab-ssh, but without success.

gitlab_sshd['public_key_algorithms'] in gitlab.rb is set like this:

gitlab_sshd['public_key_algorithms'] = ['ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-ed25519', 'rsa-sha2-256', 'rsa-sha2-512']

It also looks like correct config is generated:

sshd: {"concurrent_sessions_limit":100,"proxy_protocol":true,"proxy_policy":"use","proxy_header_timeout":"500ms","grace_period":55,"client_alive_interval":null,"ciphers":null,"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521"],"macs":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"public_key_algorithms":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-256","rsa-sha2-512"],"login_grace_time":60,"host_key_files":["/var/opt/gitlab/gitlab-sshd/ssh_host_ecdsa_key","/var/opt/gitlab/gitlab-sshd/ssh_host_ed25519_key","/var/opt/gitlab/gitlab-sshd/ssh_host_rsa_key"],"host_key_certs":[],"listen":"[::]:2222","web_listen":"localhost:9122"}

And even log when starting SSH server looks good:

{"correlation_id":"XXXX","level":"info","msg":"Listening for SSH connections","supported_public_key_algorithms":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-256","rsa-sha2-512"],"tcp_address":"0.0.0.0:2222","time":"XXX"}

But nmap stills shows ssh-rsa as supported algorithm:

PORT     STATE SERVICE
2222/tcp open  EtherNetIP-1
| ssh2-enum-algos: 
|   kex_algorithms: (6)
|       curve25519-sha256
|       curve25519-sha256@libssh.org
|       ecdh-sha2-nistp256
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp521
|       kex-strict-s-v00@openssh.com
|   server_host_key_algorithms: (5)
|       ecdsa-sha2-nistp256
|       ssh-ed25519
|       rsa-sha2-256
|       rsa-sha2-512
|       ssh-rsa
|   encryption_algorithms: (6)
|       aes128-gcm@openssh.com
|       aes256-gcm@openssh.com
|       chacha20-poly1305@openssh.com
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|   mac_algorithms: (4)
|       hmac-sha2-256-etm@openssh.com
|       hmac-sha2-512-etm@openssh.com
|       hmac-sha2-256
|       hmac-sha2-512
|   compression_algorithms: (1)
|_      none

Version used: gitlab-ce-17.6.2-ce.0.el8.src.rpm

Edited by Jakub Onderka