diff --git a/extensions/resteasy-classic/resteasy/deployment/src/test/java/io/quarkus/resteasy/test/UserFriendlyQuarkusRESTCapabilityCombinationTest.java b/extensions/resteasy-classic/resteasy/deployment/src/test/java/io/quarkus/resteasy/test/UserFriendlyQuarkusRESTCapabilityCombinationTest.java
new file mode 100644
index 0000000000000..371aebc339999
--- /dev/null
+++ b/extensions/resteasy-classic/resteasy/deployment/src/test/java/io/quarkus/resteasy/test/UserFriendlyQuarkusRESTCapabilityCombinationTest.java
@@ -0,0 +1,31 @@
+package io.quarkus.resteasy.test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import java.util.List;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import io.quarkus.builder.Version;
+import io.quarkus.deployment.Capability;
+import io.quarkus.maven.dependency.Dependency;
+import io.quarkus.test.QuarkusUnitTest;
+
+class UserFriendlyQuarkusRESTCapabilityCombinationTest {
+
+    @RegisterExtension
+    static final QuarkusUnitTest config = new QuarkusUnitTest()
+            .setForcedDependencies(List.of(Dependency.of("io.quarkus", "quarkus-rest-deployment", Version.getVersion())))
+            .assertException(t -> {
+                assertTrue(t.getMessage().contains("only one provider of the following capabilities"), t.getMessage());
+                assertTrue(t.getMessage().contains("capability %s is provided by".formatted(Capability.REST)), t.getMessage());
+            });
+
+    @Test
+    public void test() {
+        fail();
+    }
+
+}
diff --git a/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java b/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java
index ce61a24f2eeae..f60e39ce1bf3f 100644
--- a/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java
+++ b/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java
@@ -55,6 +55,7 @@
 import io.quarkus.arc.processor.BuildExtension;
 import io.quarkus.arc.processor.ObserverInfo;
 import io.quarkus.builder.item.MultiBuildItem;
+import io.quarkus.deployment.Capabilities;
 import io.quarkus.deployment.Feature;
 import io.quarkus.deployment.annotations.BuildProducer;
 import io.quarkus.deployment.annotations.BuildStep;
@@ -519,6 +520,7 @@ void transformSecurityAnnotations(BuildProducer<AnnotationsTransformerBuildItem>
         }
     }
 
+    @Consume(Capabilities.class) // make sure extension combinations are validated before default security check
     @BuildStep
     @Record(ExecutionTime.STATIC_INIT)
     void gatherSecurityChecks(BuildProducer<SyntheticBeanBuildItem> syntheticBeans,
@@ -529,7 +531,7 @@ void gatherSecurityChecks(BuildProducer<SyntheticBeanBuildItem> syntheticBeans,
             BuildProducer<RunTimeConfigBuilderBuildItem> configBuilderProducer,
             List<AdditionalSecuredMethodsBuildItem> additionalSecuredMethods,
             SecurityCheckRecorder recorder,
-            Optional<DefaultSecurityCheckBuildItem> defaultSecurityCheckBuildItem,
+            List<DefaultSecurityCheckBuildItem> defaultSecurityCheckBuildItem,
             BuildProducer<ReflectiveClassBuildItem> reflectiveClassBuildItemBuildProducer,
             List<AdditionalSecurityCheckBuildItem> additionalSecurityChecks, SecurityBuildTimeConfig config) {
         classPredicate.produce(new ApplicationClassPredicateBuildItem(new SecurityCheckStorageAppPredicate()));
@@ -563,8 +565,14 @@ void gatherSecurityChecks(BuildProducer<SyntheticBeanBuildItem> syntheticBeans,
                     methodEntry.getValue());
         }
 
-        if (defaultSecurityCheckBuildItem.isPresent()) {
-            var roles = defaultSecurityCheckBuildItem.get().getRolesAllowed();
+        if (!defaultSecurityCheckBuildItem.isEmpty()) {
+            if (defaultSecurityCheckBuildItem.size() > 1) {
+                int itemCount = defaultSecurityCheckBuildItem.size();
+                throw new IllegalStateException("Found %d DefaultSecurityCheckBuildItem items, ".formatted(itemCount)
+                        + "please make sure the item is produced exactly once");
+            }
+
+            var roles = defaultSecurityCheckBuildItem.get(0).getRolesAllowed();
             if (roles == null) {
                 recorder.registerDefaultSecurityCheck(builder, recorder.denyAll());
             } else {
diff --git a/extensions/security/spi/src/main/java/io/quarkus/security/spi/DefaultSecurityCheckBuildItem.java b/extensions/security/spi/src/main/java/io/quarkus/security/spi/DefaultSecurityCheckBuildItem.java
index ed3dafe18de0d..67765b5728cf1 100644
--- a/extensions/security/spi/src/main/java/io/quarkus/security/spi/DefaultSecurityCheckBuildItem.java
+++ b/extensions/security/spi/src/main/java/io/quarkus/security/spi/DefaultSecurityCheckBuildItem.java
@@ -3,9 +3,16 @@
 import java.util.List;
 import java.util.Objects;
 
-import io.quarkus.builder.item.SimpleBuildItem;
-
-public final class DefaultSecurityCheckBuildItem extends SimpleBuildItem {
+import io.quarkus.builder.item.MultiBuildItem;
+
+/**
+ * Registers default SecurityCheck with the SecurityCheckStorage.
+ * Please make sure this build item is produced exactly once or validation will fail and exception will be thrown.
+ */
+public final class DefaultSecurityCheckBuildItem
+        // we make this Multi to run CapabilityAggregationStep#aggregateCapabilities first
+        // so that user-friendly error message is logged when Quarkus REST and RESTEasy are used together
+        extends MultiBuildItem {
 
     public final List<String> rolesAllowed;