diff --git a/ChangeLog b/ChangeLog
index 6616bb4..a76b3cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,5 @@
 0.9.3
+	- PLAIN mechanism is used only when no other mechanisms are supported
 	- Legacy authentication is disabled by default, can be enabled with
 	  connection flag XMPP_CONN_FLAG_LEGACY_AUTH
 	- Session is not established if it is optional
diff --git a/src/auth.c b/src/auth.c
index a23504e..8152b40 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -259,6 +259,10 @@ static int _handle_features(xmpp_conn_t * const conn,
 	}
     }
 
+    /* Disable PLAIN when other secure mechanisms are supported */
+    if (conn->sasl_support & ~(SASL_MASK_PLAIN | SASL_MASK_ANONYMOUS))
+        conn->sasl_support &= ~SASL_MASK_PLAIN;
+
     _auth(conn);
 
     return 0;