diff --git a/app/models/key.rb b/app/models/key.rb
index 8be29c697f1..9c74ca84753 100644
--- a/app/models/key.rb
+++ b/app/models/key.rb
@@ -4,6 +4,8 @@ class Key < ActiveRecord::Base
   include AfterCommitQueue
   include Sortable
 
+  LAST_USED_AT_REFRESH_TIME = 1.day.to_i
+
   belongs_to :user
 
   before_validation :generate_fingerprint
@@ -50,7 +52,10 @@ class Key < ActiveRecord::Base
   end
 
   def update_last_used_at
-    UseKeyWorker.perform_async(self.id)
+    lease = Gitlab::ExclusiveLease.new("key_update_last_used_at:#{id}", timeout: LAST_USED_AT_REFRESH_TIME)
+    return unless lease.try_obtain
+
+    UseKeyWorker.perform_async(id)
   end
 
   def add_to_shell
diff --git a/changelogs/unreleased/record-used-ssh-keys-once-per-day.yml b/changelogs/unreleased/record-used-ssh-keys-once-per-day.yml
new file mode 100644
index 00000000000..9af9e3833c6
--- /dev/null
+++ b/changelogs/unreleased/record-used-ssh-keys-once-per-day.yml
@@ -0,0 +1,4 @@
+---
+title: Record used SSH keys only once per day
+merge_request: 8655
+author:
diff --git a/spec/models/key_spec.rb b/spec/models/key_spec.rb
index 5eaddd822be..7c40cfd8253 100644
--- a/spec/models/key_spec.rb
+++ b/spec/models/key_spec.rb
@@ -30,11 +30,30 @@ describe Key, models: true do
     end
 
     describe "#update_last_used_at" do
-      it "enqueues a UseKeyWorker job" do
-        key = create(:key)
+      let(:key) { create(:key) }
 
-        expect(UseKeyWorker).to receive(:perform_async).with(key.id)
-        key.update_last_used_at
+      context 'when key was not updated during the last day' do
+        before do
+          allow_any_instance_of(Gitlab::ExclusiveLease).to receive(:try_obtain).
+            and_return('000000')
+        end
+
+        it 'enqueues a UseKeyWorker job' do
+          expect(UseKeyWorker).to receive(:perform_async).with(key.id)
+          key.update_last_used_at
+        end
+      end
+
+      context 'when key was updated during the last day' do
+        before do
+          allow_any_instance_of(Gitlab::ExclusiveLease).to receive(:try_obtain).
+            and_return(false)
+        end
+
+        it 'does not enqueue a UseKeyWorker job' do
+          expect(UseKeyWorker).not_to receive(:perform_async)
+          key.update_last_used_at
+        end
       end
     end
   end