diff --git a/plugin/src/test/java/org/elasticsearch/xpack/security/SecurityClusterClientYamlTestCase.java b/plugin/src/test/java/org/elasticsearch/xpack/security/SecurityClusterClientYamlTestCase.java
index 30fa0e03419..fb6b6b90e1f 100644
--- a/plugin/src/test/java/org/elasticsearch/xpack/security/SecurityClusterClientYamlTestCase.java
+++ b/plugin/src/test/java/org/elasticsearch/xpack/security/SecurityClusterClientYamlTestCase.java
@@ -5,6 +5,8 @@
  */
 package org.elasticsearch.xpack.security;
 
+import org.apache.http.HttpEntity;
+import org.apache.http.util.EntityUtils;
 import org.elasticsearch.Version;
 import org.elasticsearch.client.Response;
 import org.elasticsearch.test.rest.yaml.ClientYamlTestCandidate;
@@ -12,10 +14,8 @@ import org.elasticsearch.test.rest.yaml.ESClientYamlSuiteTestCase;
 import org.elasticsearch.test.rest.yaml.ObjectPath;
 import org.junit.Before;
 
-import java.util.Collections;
-import java.util.HashSet;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
-import java.util.Set;
 
 import static org.elasticsearch.xpack.security.SecurityLifecycleService.SECURITY_TEMPLATE_NAME;
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
@@ -37,18 +37,33 @@ public abstract class SecurityClusterClientYamlTestCase extends ESClientYamlSuit
     }
 
     public static void waitForSecurity() throws Exception {
+        String masterNode = null;
+        HttpEntity entity = client().performRequest("GET", "/_cat/nodes?h=id,master").getEntity();
+        String catNodesResponse = EntityUtils.toString(entity, StandardCharsets.UTF_8);
+        for (String line : catNodesResponse.split("\n")) {
+            int indexOfStar = line.indexOf('*'); // * in the node's output denotes it is master
+            if (indexOfStar != -1) {
+                masterNode = line.substring(0, indexOfStar).trim();
+                break;
+            }
+        }
+        assertNotNull(masterNode);
+        final String masterNodeId = masterNode;
+
         assertBusy(() -> {
             try {
                 Response nodesResponse = client().performRequest("GET", "/_nodes");
                 ObjectPath nodesPath = ObjectPath.createFromResponse(nodesResponse);
                 Map<String, Object> nodes = nodesPath.evaluate("nodes");
-                Set<Version> nodeVersions = new HashSet<>();
+                Version masterVersion = null;
                 for (String nodeId : nodes.keySet()) {
-                    String nodeVersionPath = "nodes." + nodeId + ".version";
-                    Version nodeVersion = Version.fromString(nodesPath.evaluate(nodeVersionPath));
-                    nodeVersions.add(nodeVersion);
+                    // get the ES version number master is on
+                    if (nodeId.startsWith(masterNodeId)) {
+                        masterVersion = Version.fromString(nodesPath.evaluate("nodes." + nodeId + ".version"));
+                        break;
+                    }
                 }
-                Version highestNodeVersion = Collections.max(nodeVersions);
+                assertNotNull(masterVersion);
 
                 Response response = client().performRequest("GET", "/_cluster/state/metadata");
                 ObjectPath objectPath = ObjectPath.createFromResponse(response);
@@ -59,7 +74,7 @@ public abstract class SecurityClusterClientYamlTestCase extends ESClientYamlSuit
                 for (String key : mappings.keySet()) {
                     String templatePath = mappingsPath + "." + key + "._meta.security-version";
                     Version templateVersion = Version.fromString(objectPath.evaluate(templatePath));
-                    assertEquals(highestNodeVersion, templateVersion);
+                    assertEquals(masterVersion, templateVersion);
                 }
             } catch (Exception e) {
                 throw new AssertionError("failed to get cluster state", e);
diff --git a/qa/rolling-upgrade/build.gradle b/qa/rolling-upgrade/build.gradle
index 301246b53f9..451218c208f 100644
--- a/qa/rolling-upgrade/build.gradle
+++ b/qa/rolling-upgrade/build.gradle
@@ -18,8 +18,8 @@ dependencies {
 Closure waitWithAuth = { NodeInfo node, AntBuilder ant ->
     File tmpFile = new File(node.cwd, 'wait.success')
 
-    // wait up to twenty seconds
-    final long stopTime = System.currentTimeMillis() + 20000L;
+    // wait up to two minutes
+    final long stopTime = System.currentTimeMillis() + (2 * 60000L);
     Exception lastException = null;
 
     while (System.currentTimeMillis() < stopTime) {
@@ -119,6 +119,7 @@ subprojects {
       bwcVersion = version
       numBwcNodes = 2
       numNodes = 2
+      minimumMasterNodes = { 2 }
       clusterName = 'rolling-upgrade'
       waitCondition = waitWithAuth
       setting 'xpack.security.transport.ssl.enabled', 'true'