diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesResponse.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesResponse.java
index 3b30a097d3899..fccb22e13065d 100644
--- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesResponse.java
+++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesResponse.java
@@ -132,8 +132,9 @@ public Indices(Collection<String> indices, Collection<String> privileges,
         }
 
         public Indices(StreamInput in) throws IOException {
-            indices = Collections.unmodifiableSet(in.readSet(StreamInput::readString));
-            privileges = Collections.unmodifiableSet(in.readSet(StreamInput::readString));
+            // The use of TreeSet is to provide a consistent order that can be relied upon in tests
+            indices = Collections.unmodifiableSet(new TreeSet<>(in.readSet(StreamInput::readString)));
+            privileges = Collections.unmodifiableSet(new TreeSet<>(in.readSet(StreamInput::readString)));
             fieldSecurity = Collections.unmodifiableSet(in.readSet(input -> {
                 final String[] grant = input.readOptionalStringArray();
                 final String[] exclude = input.readOptionalStringArray();