diff --git a/mercurial/exchange.py b/mercurial/exchange.py
--- a/mercurial/exchange.py
+++ b/mercurial/exchange.py
@@ -184,6 +184,10 @@
         published = repo.filtered(b'served').revs(b'not public()')
     else:
         published = repo.revs(b'::%ln - public()', pushop.revs)
+        # we want to use pushop.revs in the revset even if they themselves are
+        # secret, but we don't want to have anything that the server won't see
+        # in the result of this expression
+        published &= repo.filtered(b'served')
     if published:
         if behavior == b'warn':
             ui.warn(
diff --git a/tests/test-phases-exchange.t b/tests/test-phases-exchange.t
--- a/tests/test-phases-exchange.t
+++ b/tests/test-phases-exchange.t
@@ -1592,6 +1592,26 @@
   (use --publish or adjust 'experimental.auto-publish' config)
   [255]
 
+trying to push a secret changeset doesn't confuse auto-publish
+
+  $ hg phase --secret --force
+  test-debug-phase: move rev 0: 1 -> 2
+  test-debug-phase: move rev 1: 1 -> 2
+
+  $ hg push --config experimental.auto-publish=abort
+  pushing to $TESTTMP/auto-publish-orig
+  abort: push would publish 1 changesets
+  (use --publish or adjust 'experimental.auto-publish' config)
+  [255]
+  $ hg push -r . --config experimental.auto-publish=abort
+  pushing to $TESTTMP/auto-publish-orig
+  abort: push would publish 1 changesets
+  (use --publish or adjust 'experimental.auto-publish' config)
+  [255]
+
+  $ hg phase --draft
+  test-debug-phase: move rev 1: 2 -> 1
+
 --publish flag makes push succeed
 
   $ hg push -r '.^' --publish --config experimental.auto-publish=abort