diff --git a/CHANGES.rst b/CHANGES.rst
index 4dab6fe..858a776 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -5,6 +5,7 @@ Products.CMFCore Changelog
 ----------------
 
 - Drop support for Python 3.7.
+- Fix reindexObjectSecurity to avoid a full reindex of affected objects
 
 
 3.5 (2024-03-23)
diff --git a/src/Products/CMFCore/CMFCatalogAware.py b/src/Products/CMFCore/CMFCatalogAware.py
index 502161f..93b85be 100644
--- a/src/Products/CMFCore/CMFCatalogAware.py
+++ b/src/Products/CMFCore/CMFCatalogAware.py
@@ -125,7 +125,8 @@ def reindexObjectSecurity(self, skip_self=False):
                                'catalog', brain_path)
                 continue
             s = getattr(ob, '_p_changed', 0)
-            ob.reindexObject(idxs=self._cmf_security_indexes)
+            ob.reindexObject(idxs=self._cmf_security_indexes,
+                             update_metadata=0)
             if s is None:
                 ob._p_deactivate()
 
diff --git a/src/Products/CMFCore/tests/test_CMFCatalogAware.py b/src/Products/CMFCore/tests/test_CMFCatalogAware.py
index a3ba09a..00fb5ce 100644
--- a/src/Products/CMFCore/tests/test_CMFCatalogAware.py
+++ b/src/Products/CMFCore/tests/test_CMFCatalogAware.py
@@ -194,9 +194,9 @@ def test_reindexObjectSecurity(self):
         foo.reindexObjectSecurity()
         log = sorted(cat.log)
         self.assertEqual(log, [
-            'reindex /site/foo %s 1' % str(CMF_SECURITY_INDEXES),
-            'reindex /site/foo/bar %s 1' % str(CMF_SECURITY_INDEXES),
-            'reindex /site/foo/hop %s 1' % str(CMF_SECURITY_INDEXES),
+            'reindex /site/foo %s 0' % str(CMF_SECURITY_INDEXES),
+            'reindex /site/foo/bar %s 0' % str(CMF_SECURITY_INDEXES),
+            'reindex /site/foo/hop %s 0' % str(CMF_SECURITY_INDEXES),
             ])
         self.assertFalse(foo.notified)
         self.assertFalse(bar.notified)
@@ -227,7 +227,7 @@ def test_reindexObjectSecurity_missing_noraise(self):
         foo.reindexObjectSecurity()
         self.assertEqual(
             cat.log,
-            ['reindex /site/foo %s 1' % str(CMF_SECURITY_INDEXES)])
+            ['reindex /site/foo %s 0' % str(CMF_SECURITY_INDEXES)])
         self.assertFalse(foo.notified)
         self.assertFalse(missing.notified)
         self.assertEqual(len(self.logged), 1)  # logging because no raise