I've never seen a security best practice that says use a password for SSH when SSH keys are available and the password can be disabled.

So use SSH keys or better still certs.