diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
index 5f171b72fd6..bfb517c3299 100644
--- a/solr/CHANGES.txt
+++ b/solr/CHANGES.txt
@@ -244,6 +244,9 @@ Bug Fixes
 * SOLR-5673: HTTPSolrServer doesn't set own property correctly in
   setFollowRedirects. (Frank Wesemann via shalin)
 
+* SOLR-5676: SolrCloud updates rejected if talking to secure ZooKeeper.
+  (Greg Chanan via Mark Miller)
+
 Optimizations
 ----------------------
 
diff --git a/solr/solrj/src/java/org/apache/solr/common/cloud/ConnectionManager.java b/solr/solrj/src/java/org/apache/solr/common/cloud/ConnectionManager.java
index d09660cb5c0..0ac1d3937e2 100644
--- a/solr/solrj/src/java/org/apache/solr/common/cloud/ConnectionManager.java
+++ b/solr/solrj/src/java/org/apache/solr/common/cloud/ConnectionManager.java
@@ -195,8 +195,8 @@ public class ConnectionManager implements Watcher {
       log.info("zkClient has disconnected");
       disconnected();
       connectionStrategy.disconnected();
-    } else {
-      disconnected();
+    } else if (state == KeeperState.AuthFailed) {
+      log.warn("zkClient received AuthFailed");
     }
   }