diff --git a/CHANGELOG.md b/CHANGELOG.md
index 258efbda..6ba708fa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 * Feature: collection sharing by map or token incl. management API
 * Add: [auth] oauth2: allow custom client_id and client_secret (optional)
+* Cleanup: deprecate config option 'ldap_use_ssl' for good
 
 ## 3.6.1
 
diff --git a/DOCUMENTATION.md b/DOCUMENTATION.md
index 43bba942..bd233726 100644
--- a/DOCUMENTATION.md
+++ b/DOCUMENTATION.md
@@ -1149,12 +1149,6 @@ login names.
 
 Default: (unset, in which case the login name is directly used as the username)
 
-##### ldap_use_ssl
-
-_(>= 3.3.0)_
-
-Use ssl on the LDAP connection. **Deprecated!** Use `ldap_security` instead.
-
 ##### ldap_security
 
 _(>= 3.5.2)_
diff --git a/config b/config
index 18e29a1f..96f18aca 100644
--- a/config
+++ b/config
@@ -101,9 +101,6 @@
 # Attribute holding the value to be used as username after authentication
 #ldap_user_attribute = cn
 
-# Use ssl on the LDAP connection (DEPRECATED - use 'ldap_security'!)
-#ldap_use_ssl = False
-
 # Encryption mode to be used. Default: none; one of: none, tls, starttls
 #ldap_security = none
 
diff --git a/radicale/auth/ldap.py b/radicale/auth/ldap.py
index aadbbf64..c2f6efd2 100644
--- a/radicale/auth/ldap.py
+++ b/radicale/auth/ldap.py
@@ -26,8 +26,6 @@ Authentication backend that checks credentials with a LDAP server.
    ldap_secret_file       Path of the file containing the password of the 'ldap_reader_dn'
    ldap_filter            Search filter to find the user DN to authenticate
  The following parameters control TLS connections:
-   ldap_use_ssl           Use ssl on the ldap connection.
-                          Deprecated, use 'ldap_security' instead!
    ldap_security          Encryption mode to be used,
                           one of: *none* | tls | starttls
    ldap_ssl_verify_mode   Certificate verification mode for tls and starttls;
@@ -104,14 +102,6 @@ class Auth(auth.BaseAuth):
         self._ldap_security = configuration.get("auth", "ldap_security")
         if self._ldap_security not in ("none", "tls", "starttls"):
             raise RuntimeError("Illegal value for config setting ´ldap_security'")
-        ldap_use_ssl = configuration.get("auth", "ldap_use_ssl")
-        if ldap_use_ssl:
-            logger.warning("Configuration uses deprecated 'ldap_use_ssl': use 'ldap_security' ('none', 'tls', 'starttls') instead.")
-            if self._ldap_security == "starttls":
-                raise RuntimeError("Deprecated config setting 'ldap_use_ssl = True' conflicts with 'ldap_security' = 'starttls'")
-            elif self._ldap_security != "tls":
-                logger.warning("Update configuration: set 'ldap_security = tls' instead of deprecated 'ldap_use_ssl = True'")
-                self._ldap_security = "tls"
         self._ldap_ssl_ca_file = configuration.get("auth", "ldap_ssl_ca_file")
         self._ldap_ssl_verify_mode = configuration.get("auth", "ldap_ssl_verify_mode")
         if self._ldap_ssl_verify_mode not in ("NONE", "OPTIONAL", "REQUIRED"):
@@ -165,7 +155,6 @@ class Auth(auth.BaseAuth):
         if self._ldap_reader_dn and not self._ldap_secret:
             logger.error("auth.ldap_secret           : (not provided)")
             raise RuntimeError("LDAP authentication requires ldap_secret for ldap_reader_dn")
-        logger.info("auth.ldap_use_ssl           : %s" % ldap_use_ssl)
         logger.info("auth.ldap_security          : %s" % self._ldap_security)
         logger.info("auth.ldap_ssl_verify_mode   : %s" % self._ldap_ssl_verify_mode)
         if self._ldap_ssl_ca_file:
diff --git a/radicale/config.py b/radicale/config.py
index 6cc0460d..bc015ee6 100644
--- a/radicale/config.py
+++ b/radicale/config.py
@@ -306,10 +306,6 @@ DEFAULT_CONFIG_SCHEMA: types.CONFIG_SCHEMA = OrderedDict([
             "value": "",
             "help": "Attribute to be used as username after authentication",
             "type": str}),
-        ("ldap_use_ssl", {
-            "value": "False",
-            "help": "Use ssl on the LDAP connection. Deprecated, use ldap_security instead!",
-            "type": bool}),
         ("ldap_security", {
             "value": "none",
             "help": "Encryption mode to be used: *none*|tls|starttls",