During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/main/java/org/elasticsearch/node/Node.java
final TaskManager taskManager = new TaskManager(settings, threadPool, taskHeaders, tracer);
            
            final List<Setting<?>> additionalSettings = new ArrayList<>(pluginsService.flatMap(Plugin::getSettings).toList());
            for (final ExecutorBuilder<?> builder : threadPool.builders()) {
                additionalSettings.addAll(builder.getRegisteredSettings());
            }
            SettingsExtension.load().forEach(e -> additionalSettings.addAll(e.getSettings()));
            client = new NodeClient(settings, threadPool);
            final ScriptModule scriptModule = new ScriptModule(settings, pluginsService.filterPlugins(ScriptPlugin.class));
            final ScriptService scriptService = newScriptService(
                settings,
                scriptModule.engines,
                scriptModule.contexts,
                threadPool::absoluteTimeInMillis
            );
            AnalysisModule analysisModule = new AnalysisModule(
                this.environment,
                pluginsService.filterPlugins(AnalysisPlugin.class),
                pluginsService.getStablePluginRegistry()
            );
            
            
            final SettingsModule settingsModule = new SettingsModule(
                settings,
                additionalSettings,
                pluginsService.flatMap(Plugin::getSettingsFilter).toList()
            );
            
            
            nodeEnvironment = new NodeEnvironment(tmpSettings, environment);