diff --git a/plugin/src/test/java/org/elasticsearch/test/SecurityIntegTestCase.java b/plugin/src/test/java/org/elasticsearch/test/SecurityIntegTestCase.java
index 875d7b17426..de4681568ab 100644
--- a/plugin/src/test/java/org/elasticsearch/test/SecurityIntegTestCase.java
+++ b/plugin/src/test/java/org/elasticsearch/test/SecurityIntegTestCase.java
@@ -20,7 +20,6 @@ import org.elasticsearch.cluster.health.ClusterHealthStatus;
 import org.elasticsearch.cluster.metadata.AliasOrIndex;
 import org.elasticsearch.cluster.metadata.MetaData;
 import org.elasticsearch.cluster.routing.IndexRoutingTable;
-import org.elasticsearch.cluster.service.ClusterService;
 import org.elasticsearch.common.network.NetworkAddress;
 import org.elasticsearch.common.settings.MockSecureSettings;
 import org.elasticsearch.common.settings.SecureString;
@@ -452,13 +451,13 @@ public abstract class SecurityIntegTestCase extends ESIntegTestCase {
     }
 
     public void assertSecurityIndexActive() throws Exception {
-        assertSecurityIndexActive(internalCluster());
+        assertSecurityIndexActive(cluster());
     }
 
-    public void assertSecurityIndexActive(InternalTestCluster internalTestCluster) throws Exception {
-        for (ClusterService clusterService : internalTestCluster.getInstances(ClusterService.class)) {
+    public void assertSecurityIndexActive(TestCluster testCluster) throws Exception {
+        for (Client client : testCluster.getClients()) {
             assertBusy(() -> {
-                ClusterState clusterState = clusterService.state();
+                ClusterState clusterState = client.admin().cluster().prepareState().setLocal(true).get().getState();
                 assertFalse(clusterState.blocks().hasGlobalBlock(GatewayService.STATE_NOT_RECOVERED_BLOCK));
                 assertTrue(securityIndexMappingAndTemplateSufficientToRead(clusterState, logger));
                 Index securityIndex = resolveSecurityIndex(clusterState.metaData());
@@ -473,9 +472,13 @@ public abstract class SecurityIntegTestCase extends ESIntegTestCase {
     }
 
     public void assertSecurityIndexWriteable() throws Exception {
-        for (ClusterService clusterService : internalCluster().getInstances(ClusterService.class)) {
+        assertSecurityIndexWriteable(cluster());
+    }
+
+    public void assertSecurityIndexWriteable(TestCluster testCluster) throws Exception {
+        for (Client client : testCluster.getClients()) {
             assertBusy(() -> {
-                ClusterState clusterState = clusterService.state();
+                ClusterState clusterState = client.admin().cluster().prepareState().setLocal(true).get().getState();
                 assertFalse(clusterState.blocks().hasGlobalBlock(GatewayService.STATE_NOT_RECOVERED_BLOCK));
                 assertTrue(securityIndexMappingAndTemplateUpToDate(clusterState, logger));
                 Index securityIndex = resolveSecurityIndex(clusterState.metaData());
diff --git a/qa/tribe-tests-with-security/src/test/java/org/elasticsearch/test/TribeWithSecurityIT.java b/qa/tribe-tests-with-security/src/test/java/org/elasticsearch/test/TribeWithSecurityIT.java
index e7dc9c47802..2a0ce60d95b 100644
--- a/qa/tribe-tests-with-security/src/test/java/org/elasticsearch/test/TribeWithSecurityIT.java
+++ b/qa/tribe-tests-with-security/src/test/java/org/elasticsearch/test/TribeWithSecurityIT.java
@@ -7,7 +7,6 @@ package org.elasticsearch.test;
 
 
 import com.carrotsearch.hppc.cursors.ObjectCursor;
-import org.apache.lucene.util.LuceneTestCase;
 import org.elasticsearch.action.admin.cluster.health.ClusterHealthResponse;
 import org.elasticsearch.cluster.ClusterState;
 import org.elasticsearch.cluster.metadata.IndexMetaData;
@@ -114,6 +113,7 @@ public class TribeWithSecurityIT extends SecurityIntegTestCase {
     }
 
     public void testThatTribeCanAuthenticateElasticUserWithChangedPassword() throws Exception {
+        assertSecurityIndexWriteable();
         securityClient(client()).prepareChangePassword("elastic", "password".toCharArray()).get();
 
         assertTribeNodeHasAllIndices();
@@ -124,6 +124,8 @@ public class TribeWithSecurityIT extends SecurityIntegTestCase {
     }
 
     public void testThatTribeClustersHaveDifferentPasswords() throws Exception {
+        assertSecurityIndexWriteable();
+        assertSecurityIndexWriteable(cluster2);
         securityClient().prepareChangePassword("elastic", "password".toCharArray()).get();
         securityClient(cluster2.client()).prepareChangePassword("elastic", "password2".toCharArray()).get();
 
@@ -153,6 +155,7 @@ public class TribeWithSecurityIT extends SecurityIntegTestCase {
         final int randomRoles = scaledRandomIntBetween(3, 8);
         List<String> shouldBeSuccessfulRoles = new ArrayList<>();
 
+        assertSecurityIndexWriteable();
         for (int i = 0; i < randomRoles; i++) {
             final String rolename = "preferredClusterRole" + i;
             PutRoleResponse response = securityClient(client()).preparePutRole(rolename).cluster("monitor").get();