diff --git a/src/opts.c b/src/opts.c
index da72a3d99..608ac65de 100644
--- a/src/opts.c
+++ b/src/opts.c
@@ -367,12 +367,10 @@ natsOptions_SetSecure(natsOptions *opts, bool secure)
 natsStatus
 natsOptions_TLSHandshakeFirst(natsOptions *opts)
 {
-    natsStatus s = NATS_OK;
-
     LOCK_AND_CHECK_OPTIONS(opts, 0);
 
     opts->tlsHandshakeFirst = true;
-    opts->secure            = true;
+    natsStatus s = natsOptions_SetSecure(opts, true);
 
     UNLOCK_OPTS(opts);
 
diff --git a/test/test.c b/test/test.c
index a7aa56118..ceeecf9cd 100644
--- a/test/test.c
+++ b/test/test.c
@@ -21324,6 +21324,22 @@ void test_SSLHandshakeFirst(void)
     s = natsOptions_TLSHandshakeFirst(opts);
     testCond(s == NATS_OK);
 
+    test("Set TLSHandshakeFirst option without setting secure: ");
+    {
+        // we start with a new natsOptions struct so that we can test
+        // that it does not crash with a minimal config
+        natsOptions *opts = NULL;
+        s = natsOptions_Create(&opts);
+        IFOK(s, natsOptions_SetURL(opts, "nats://127.0.0.1:4443"));
+        IFOK(s, natsOptions_SetTimeout(opts, 500));
+        s = natsOptions_TLSHandshakeFirst(opts);
+        IFOK(s, natsConnection_Connect(&nc, opts));
+        testCond(s == NATS_SSL_ERROR);
+        natsConnection_Destroy(nc);
+        natsOptions_Destroy(opts);
+        nats_clearLastError();
+    }
+
     test("Check that connect succeeds: ");
     s = natsConnection_Connect(&nc, opts);
     testCond(s == NATS_OK);