diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0717d9c22..756b3a4b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Fixed
 - GAP: fix gap_connect_cancel for gap_connect_with_whitelist
+- GAP: fix race condition that causes duplicate authenticate request
 - L2CAP: Fix accept incoming ERTM connection when Information Request already complete
 - HFP AG: activate all AG indicators upon service level connection establishment
 - HFP_AG: handle call termination in alerting call state
diff --git a/src/hci.c b/src/hci.c
index 6dae414d1..00684ab24 100644
--- a/src/hci.c
+++ b/src/hci.c
@@ -6961,12 +6961,11 @@ void gap_request_security_level(hci_con_handle_t con_handle, gap_security_level_
         // store request
         connection->requested_security_level = requested_level;
 
-        // request remote features if not already active
-        hci_remote_features_query(con_handle);
-
         // start to authenticate connection
         connection->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
-        hci_run();
+
+        // request remote features if not already active, also trigger hci_run
+        hci_remote_features_query(con_handle);
     }
 }