--- a/mercurial/exchange.py	Thu Jul 01 18:51:18 2021 +0200
+++ b/mercurial/exchange.py	Sat Jul 03 10:21:16 2021 +0300
@@ -184,6 +184,10 @@
         published = repo.filtered(b'served').revs(b'not public()')
     else:
         published = repo.revs(b'::%ln - public()', pushop.revs)
+        # we want to use pushop.revs in the revset even if they themselves are
+        # secret, but we don't want to have anything that the server won't see
+        # in the result of this expression
+        published &= repo.filtered(b'served')
     if published:
         if behavior == b'warn':
             ui.warn(