diff --git a/dependencies/spring-security-dependencies.gradle b/dependencies/spring-security-dependencies.gradle
index c78bac1494..96a6c3514a 100644
--- a/dependencies/spring-security-dependencies.gradle
+++ b/dependencies/spring-security-dependencies.gradle
@@ -8,7 +8,7 @@ javaPlatform {
 
 dependencies {
 	api platform("org.springframework:spring-framework-bom:$springFrameworkVersion")
-	api platform("io.projectreactor:reactor-bom:2020.0.19")
+	api platform("io.projectreactor:reactor-bom:2022.0.0-M2")
 	api platform("io.rsocket:rsocket-bom:1.1.2")
 	api platform("org.junit:junit-bom:5.9.0-M1")
 	api platform("org.springframework.data:spring-data-bom:2022.0.0-M4")
diff --git a/test/src/main/java/org/springframework/security/test/context/support/ReactorContextTestExecutionListener.java b/test/src/main/java/org/springframework/security/test/context/support/ReactorContextTestExecutionListener.java
index dd6dbad701..187bc9ced5 100644
--- a/test/src/main/java/org/springframework/security/test/context/support/ReactorContextTestExecutionListener.java
+++ b/test/src/main/java/org/springframework/security/test/context/support/ReactorContextTestExecutionListener.java
@@ -107,7 +107,7 @@ public class ReactorContextTestExecutionListener extends DelegatingTestExecution
 					return context;
 				}
 				Context toMerge = ReactiveSecurityContextHolder.withSecurityContext(Mono.just(this.securityContext));
-				return toMerge.putAll(context);
+				return toMerge.putAll(context.readOnly());
 			}
 
 			@Override
diff --git a/web/src/main/java/org/springframework/security/web/server/context/ReactorContextWebFilter.java b/web/src/main/java/org/springframework/security/web/server/context/ReactorContextWebFilter.java
index 0e8ce6612c..47fe10a446 100644
--- a/web/src/main/java/org/springframework/security/web/server/context/ReactorContextWebFilter.java
+++ b/web/src/main/java/org/springframework/security/web/server/context/ReactorContextWebFilter.java
@@ -49,8 +49,8 @@ public class ReactorContextWebFilter implements WebFilter {
 	}
 
 	private Context withSecurityContext(Context mainContext, ServerWebExchange exchange) {
-		return mainContext
-				.putAll(this.repository.load(exchange).as(ReactiveSecurityContextHolder::withSecurityContext));
+		return mainContext.putAll(
+				this.repository.load(exchange).as(ReactiveSecurityContextHolder::withSecurityContext).readOnly());
 	}
 
 }