When a client sends a find command on an FLE2 encrypted collection directly to a secondary (e.g by way of readPreference {mode: "secondary"} ), the server always returns the error code NotPrimaryNoSecondaryOk with error message "not master and slaveOk=false". Cursory debugging reveals that this error happens on a count command; and occurs when rewriteQuery() starts an internal transaction that calls queryImpl->countDocuments() here.