diff --git a/libfreerdp/core/credssp_auth.c b/libfreerdp/core/credssp_auth.c
index b2c565d42..eb6ead0cc 100644
--- a/libfreerdp/core/credssp_auth.c
+++ b/libfreerdp/core/credssp_auth.c
@@ -498,6 +498,8 @@ BOOL credssp_auth_encrypt(rdpCredsspAuth* auth, const SecBuffer* plaintext, SecB
 	buffers[0].pvBuffer = buf;
 
 	buffers[1].BufferType = SECBUFFER_DATA;
+	if (plaintext->BufferType & SECBUFFER_READONLY)
+		buffers[1].BufferType |= SECBUFFER_READONLY;
 	buffers[1].pvBuffer = buf + auth->sizes.cbSecurityTrailer;
 	buffers[1].cbBuffer = plaintext->cbBuffer;
 	CopyMemory(buffers[1].pvBuffer, plaintext->pvBuffer, plaintext->cbBuffer);
diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c
index 3c98a5115..e0edaed18 100644
--- a/libfreerdp/core/gateway/rpc_client.c
+++ b/libfreerdp/core/gateway/rpc_client.c
@@ -1064,6 +1064,7 @@ BOOL rpc_client_write_call(rdpRpc* rpc, wStream* s, UINT16 opnum)
 
 	plaintext.pvBuffer = buffer;
 	plaintext.cbBuffer = offset;
+	plaintext.BufferType = SECBUFFER_READONLY;
 	if (!credssp_auth_encrypt(auth, &plaintext, &ciphertext, &size, rpc->SendSeqNum++))
 		goto fail;