diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2d3d2073ea4aa35cccbd33f36692d45ab32a8736..ba082598ba3d0677b7298bd175b40f79b973c817 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- [borg] don't hardcode ssh port default (DEBBUG-993951)
 - [core] allow for disabling reports by email
 
 ### Fixed
diff --git a/handlers/borg.in b/handlers/borg.in
index 582e0a617268d7765ffd4b6de5c8f0cd6699d714..845f3d56984e0849387d58d8666a0add2370218e 100644
--- a/handlers/borg.in
+++ b/handlers/borg.in
@@ -41,7 +41,7 @@ getconf ignore_missing
 setsection dest
 getconf user
 getconf host
-getconf port 22
+getconf port
 getconf directory
 # strip trailing /
 directory=${directory%/}
@@ -69,7 +69,7 @@ fi
 if [ "$host" != "localhost" ]; then
    [ -n "$user" ] || fatal "Destination user not set"
    [ -n "$host" ] || fatal "Destination host not set"
-  execstr_repository="ssh://${user}@${host}:${port}${directory}"
+  execstr_repository="ssh://${user}@${host}${port:+:${port}}${directory}"
 else
   execstr_repository="$directory"
 fi
@@ -104,8 +104,8 @@ fi
 # check the connection at the source and destination
 [ -n "$test" ] || test=0
 if [ "$host" != "localhost" ] && ([ "$testconnect" = "yes" ] || [ "${test}" -eq 1 ]); then
-   debug "ssh $sshoptions -o PasswordAuthentication=no $host -p $port -l $user 'echo -n 1'"
-   local ret=`ssh $sshoptions -o PasswordAuthentication=no $host -p $port -l $user 'echo -n 1'`
+   debug "ssh $sshoptions -o PasswordAuthentication=no ${host}${port:+ -p ${port}} -l $user 'echo -n 1'"
+   local ret=`ssh $sshoptions -o PasswordAuthentication=no ${host}${port:+ -p ${port}} -l $user 'echo -n 1'`
    if [ "$ret" = 1 ]; then
       debug "Connected to $host as $user successfully"
    else
diff --git a/test/borg.bats b/test/borg.bats
index a0a9e22b716b9479b4fd1ff4f4079d378c2a2c12..0a454acd0800b66fa2a0b346738c85fb01e22ab1 100644
--- a/test/borg.bats
+++ b/test/borg.bats
@@ -28,7 +28,6 @@ cache_directory =
 [dest]
 user =
 host = localhost
-port = 22
 directory = ${BN_BACKUPDIR}/testborg
 archive =
 compression = lz4
@@ -243,8 +242,8 @@ finish_borg() {
     setconfig dest user "$BN_REMOTEUSER"
     setconfig dest host "$BN_REMOTEHOST"
     testaction
-    greplog "Debug: ssh\s\+-o PasswordAuthentication=no ${BN_REMOTEHOST} -p 22 -l ${BN_REMOTEUSER} 'echo -n 1'"
-    greplog 'Debug: executing borg create$' "\bssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}:22${BN_BACKUPDIR}/testborg::"
+    greplog "Debug: ssh\s\+-o PasswordAuthentication=no ${BN_REMOTEHOST} -l ${BN_REMOTEUSER} 'echo -n 1'"
+    greplog 'Debug: executing borg create$' "\bssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}${BN_BACKUPDIR}/testborg::"
 }
 
 @test "check config parameter dest/host" {
@@ -258,18 +257,18 @@ finish_borg() {
     setconfig dest user "$BN_REMOTEUSER"
     setconfig dest host "$BN_REMOTEHOST"
     testaction
-    greplog "Debug: ssh\s\+-o PasswordAuthentication=no ${BN_REMOTEHOST} -p 22 -l ${BN_REMOTEUSER} 'echo -n 1'"
-    greplog 'Debug: executing borg create$' "\bssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}:22${BN_BACKUPDIR}/testborg::"
+    greplog "Debug: ssh\s\+-o PasswordAuthentication=no ${BN_REMOTEHOST} -l ${BN_REMOTEUSER} 'echo -n 1'"
+    greplog 'Debug: executing borg create$' "\bssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}${BN_BACKUPDIR}/testborg::"
 }
 
 @test "check config parameter dest/port" {
-    # absent parameter, defaults to 22
+    # absent parameter, port not specified
     setconfig dest user "$BN_REMOTEUSER"
     setconfig dest host "$BN_REMOTEHOST"
     delconfig dest port
     testaction
-    greplog "Debug: ssh\s\+ -o PasswordAuthentication=no ${BN_REMOTEHOST} -p 22 -l ${BN_REMOTEUSER} 'echo -n 1'"
-    greplog 'Debug: executing borg create$' "\bssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}:22${BN_BACKUPDIR}/testborg::"
+    greplog "Debug: ssh\s\+-o PasswordAuthentication=no ${BN_REMOTEHOST} -l ${BN_REMOTEUSER} 'echo -n 1'"
+    greplog 'Debug: executing borg create$' "\bssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}${BN_BACKUPDIR}/testborg::"
 
     # defined parameter
     setconfig dest port 7722
@@ -385,8 +384,8 @@ finish_borg() {
 
 @test "verify remote backup with encryption" {
     export BORG_PASSPHRASE="123foo"
-    run borg extract --dry-run "ssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}:22${BN_BACKUPDIR}/testborg::testarchive"
+    run borg extract --dry-run "ssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}${BN_BACKUPDIR}/testborg::testarchive"
     [ "$status" -eq 2 ]
     export BORG_PASSPHRASE="123test"
-    borg extract --dry-run "ssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}:22${BN_BACKUPDIR}/testborg::testarchive"
+    borg extract --dry-run "ssh://${BN_REMOTEUSER}@${BN_REMOTEHOST}${BN_BACKUPDIR}/testborg::testarchive"
 }