diff --git a/changelogs/fragments/65624-paramiko-ctx-man.yml b/changelogs/fragments/65624-paramiko-ctx-man.yml
new file mode 100644
index 00000000000..8dcbea81897
--- /dev/null
+++ b/changelogs/fragments/65624-paramiko-ctx-man.yml
@@ -0,0 +1,2 @@
+bugfixes:
+  - paramiko_ssh - optimized file handling by using a context manager.
diff --git a/lib/ansible/plugins/connection/paramiko_ssh.py b/lib/ansible/plugins/connection/paramiko_ssh.py
index d955543248f..b0423473aef 100644
--- a/lib/ansible/plugins/connection/paramiko_ssh.py
+++ b/lib/ansible/plugins/connection/paramiko_ssh.py
@@ -517,25 +517,23 @@ class Connection(ConnectionBase):
         path = os.path.expanduser("~/.ssh")
         makedirs_safe(path)
 
-        f = open(filename, 'w')
+        with open(filename, 'w') as f:
 
-        for hostname, keys in iteritems(self.ssh._host_keys):
-
-            for keytype, key in iteritems(keys):
+            for hostname, keys in iteritems(self.ssh._host_keys):
 
-                # was f.write
-                added_this_time = getattr(key, '_added_by_ansible_this_time', False)
-                if not added_this_time:
-                    f.write("%s %s %s\n" % (hostname, keytype, key.get_base64()))
+                for keytype, key in iteritems(keys):
 
-        for hostname, keys in iteritems(self.ssh._host_keys):
+                    # was f.write
+                    added_this_time = getattr(key, '_added_by_ansible_this_time', False)
+                    if not added_this_time:
+                        f.write("%s %s %s\n" % (hostname, keytype, key.get_base64()))
 
-            for keytype, key in iteritems(keys):
-                added_this_time = getattr(key, '_added_by_ansible_this_time', False)
-                if added_this_time:
-                    f.write("%s %s %s\n" % (hostname, keytype, key.get_base64()))
+            for hostname, keys in iteritems(self.ssh._host_keys):
 
-        f.close()
+                for keytype, key in iteritems(keys):
+                    added_this_time = getattr(key, '_added_by_ansible_this_time', False)
+                    if added_this_time:
+                        f.write("%s %s %s\n" % (hostname, keytype, key.get_base64()))
 
     def reset(self):
         self.close()