diff --git a/CHANGELOG b/CHANGELOG
index 848a0979d3..2ffd3f6546 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,9 @@
 v3.4.0-rc.4 (XXXX-XX-XX)
 ------------------------
 
+* in a cluster environment, the arangod process now exits if wrong credentials
+  are used during the startup process.
+
 * added option `--rocksdb.total-write-buffer-size` to limit total memory usage
   across all RocksDB in-memory write buffers
 
diff --git a/arangod/Agency/AgencyComm.cpp b/arangod/Agency/AgencyComm.cpp
index b8b63b4d07..68962d08d1 100644
--- a/arangod/Agency/AgencyComm.cpp
+++ b/arangod/Agency/AgencyComm.cpp
@@ -1221,6 +1221,12 @@ bool AgencyComm::ensureStructureInitialized() {
         LOG_TOPIC(TRACE, Logger::AGENCYCOMM) << "Found an initialized agency";
         break;
       }
+    } else {
+      if (result.httpCode() == 401) {
+        // unauthorized
+        LOG_TOPIC(FATAL, Logger::STARTUP) << "Unauthorized. Wrong credentials.";
+        FATAL_ERROR_EXIT();
+      }
     }
 
     LOG_TOPIC(TRACE, Logger::AGENCYCOMM)