diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 2ca3f74ae..ee4f58e75 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -225,7 +225,11 @@ int ssl3_change_cipher_state(SSL *s, int which)
         goto err;
     }
 
-    if (EVP_CIPHER_get0_provider(c) != NULL
+    /*
+     * The cipher we actually ended up using in the EVP_CIPHER_CTX may be
+     * different to that in c if we have an ENGINE in use
+     */
+    if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL
             && !tls_provider_set_tls_params(s, dd, c, m)) {
         /* SSLfatal already called */
         goto err;
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 2b449e1bc..67b45905d 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -397,7 +397,12 @@ int tls1_change_cipher_state(SSL *s, int which)
         SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
         goto err;
     }
-    if (EVP_CIPHER_get0_provider(c) != NULL
+
+    /*
+     * The cipher we actually ended up using in the EVP_CIPHER_CTX may be
+     * different to that in c if we have an ENGINE in use
+     */
+    if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL
             && !tls_provider_set_tls_params(s, dd, c, m)) {
         /* SSLfatal already called */
         goto err;