diff --git a/core/src/main/java/org/elasticsearch/common/settings/Settings.java b/core/src/main/java/org/elasticsearch/common/settings/Settings.java
index e444dea6b79..182ea6ccb1d 100644
--- a/core/src/main/java/org/elasticsearch/common/settings/Settings.java
+++ b/core/src/main/java/org/elasticsearch/common/settings/Settings.java
@@ -718,6 +718,10 @@ public final class Settings implements ToXContent {
             if (secureSettings.isLoaded() == false) {
                 throw new IllegalStateException("Secure settings must already be loaded");
             }
+            if (this.secureSettings.get() != null) {
+                throw new IllegalArgumentException("Secure settings already set. Existing settings: " +
+                    this.secureSettings.get().getSettingNames() + ", new settings: " + secureSettings.getSettingNames());
+            }
             this.secureSettings.set(secureSettings);
             return this;
         }
diff --git a/core/src/main/java/org/elasticsearch/transport/TcpTransport.java b/core/src/main/java/org/elasticsearch/transport/TcpTransport.java
index 5db64c98b85..9631fc977c9 100644
--- a/core/src/main/java/org/elasticsearch/transport/TcpTransport.java
+++ b/core/src/main/java/org/elasticsearch/transport/TcpTransport.java
@@ -677,8 +677,8 @@ public abstract class TcpTransport<Channel> extends AbstractLifecycleComponent i
                 continue;
             }
             Settings mergedSettings = Settings.builder()
-                .put(defaultSettings)
-                .put(profileSettings)
+                .put(defaultSettings.getAsMap())
+                .put(profileSettings.getAsMap())
                 .build();
             result.put(name, mergedSettings);
         }
diff --git a/test/framework/src/main/java/org/elasticsearch/common/settings/MockSecureSettings.java b/test/framework/src/main/java/org/elasticsearch/common/settings/MockSecureSettings.java
index bb5720c99e2..22496642cb9 100644
--- a/test/framework/src/main/java/org/elasticsearch/common/settings/MockSecureSettings.java
+++ b/test/framework/src/main/java/org/elasticsearch/common/settings/MockSecureSettings.java
@@ -72,6 +72,18 @@ public class MockSecureSettings implements SecureSettings {
         settingNames.add(setting);
     }
 
+    /** Merge the given secure settings into this one. */
+    public void merge(MockSecureSettings secureSettings) {
+        for (String setting : secureSettings.getSettingNames()) {
+            if (settingNames.contains(setting)) {
+                throw new IllegalArgumentException("Cannot overwrite existing secure setting " + setting);
+            }
+        }
+        settingNames.addAll(secureSettings.settingNames);
+        secureStrings.putAll(secureSettings.secureStrings);
+        files.putAll(secureSettings.files);
+    }
+
     @Override
     public void close() throws IOException {
         closed.set(true);