diff --git a/CHANGES.txt b/CHANGES.txt
index afb333441a..3a60953d4d 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,5 +1,6 @@
 4.1.4
 Merged from 4.0:
+ * Fix BulkLoader ignoring cipher suites options (CASSANDRA-18582)
  * Migrate Python optparse to argparse (CASSANDRA-17914)
 Merged from 3.11:
 Merged from 3.0:
diff --git a/src/java/org/apache/cassandra/config/EncryptionOptions.java b/src/java/org/apache/cassandra/config/EncryptionOptions.java
index 2610ff68f2..a51e56551b 100644
--- a/src/java/org/apache/cassandra/config/EncryptionOptions.java
+++ b/src/java/org/apache/cassandra/config/EncryptionOptions.java
@@ -404,6 +404,11 @@ public class EncryptionOptions
         return ap == null ?  new String[0] : ap.toArray(new String[0]);
     }
 
+    public String[] cipherSuitesArray()
+    {
+        return cipher_suites == null ? null : cipher_suites.toArray(new String[0]);
+    }
+
     public TlsEncryptionPolicy tlsEncryptionPolicy()
     {
         if (getOptional())
diff --git a/src/java/org/apache/cassandra/tools/BulkLoader.java b/src/java/org/apache/cassandra/tools/BulkLoader.java
index ebdd072136..dccb49a6ad 100644
--- a/src/java/org/apache/cassandra/tools/BulkLoader.java
+++ b/src/java/org/apache/cassandra/tools/BulkLoader.java
@@ -273,8 +273,9 @@ public class BulkLoader
 
         // Temporarily override newSSLEngine to set accepted protocols until it is added to
         // RemoteEndpointAwareJdkSSLOptions.  See CASSANDRA-13325 and CASSANDRA-16362.
-        RemoteEndpointAwareJdkSSLOptions sslOptions = new RemoteEndpointAwareJdkSSLOptions(sslContext, null)
+        RemoteEndpointAwareJdkSSLOptions sslOptions = new RemoteEndpointAwareJdkSSLOptions(sslContext, clientEncryptionOptions.cipherSuitesArray())
         {
+            @Override
             protected SSLEngine newSSLEngine(SocketChannel channel, InetSocketAddress remoteEndpoint)
             {
                 SSLEngine engine = super.newSSLEngine(channel, remoteEndpoint);
diff --git a/test/distributed/org/apache/cassandra/distributed/test/SSTableLoaderEncryptionOptionsTest.java b/test/distributed/org/apache/cassandra/distributed/test/SSTableLoaderEncryptionOptionsTest.java
index 00834bae58..94ea1d0441 100644
--- a/test/distributed/org/apache/cassandra/distributed/test/SSTableLoaderEncryptionOptionsTest.java
+++ b/test/distributed/org/apache/cassandra/distributed/test/SSTableLoaderEncryptionOptionsTest.java
@@ -98,6 +98,7 @@ public class SSTableLoaderEncryptionOptionsTest extends AbstractEncryptionOption
                                                             "--truststore", validTrustStorePath,
                                                             "--truststore-password", validTrustStorePassword,
                                                             "--conf-path", "test/conf/sstableloader_with_encryption.yaml",
+                                                            "--ssl-ciphers", "TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA",
                                                             sstables_to_upload.absolutePath());
         tool.assertOnCleanExit();
         assertTrue(tool.getStdout().contains("Summary statistics"));
diff --git a/tools/stress/src/org/apache/cassandra/stress/util/JavaDriverClient.java b/tools/stress/src/org/apache/cassandra/stress/util/JavaDriverClient.java
index f05c513c93..f938cd9887 100644
--- a/tools/stress/src/org/apache/cassandra/stress/util/JavaDriverClient.java
+++ b/tools/stress/src/org/apache/cassandra/stress/util/JavaDriverClient.java
@@ -165,8 +165,9 @@ public class JavaDriverClient
 
             // Temporarily override newSSLEngine to set accepted protocols until it is added to
             // RemoteEndpointAwareJdkSSLOptions.  See CASSANDRA-13325 and CASSANDRA-16362.
-            RemoteEndpointAwareJdkSSLOptions sslOptions = new RemoteEndpointAwareJdkSSLOptions(sslContext, null)
+            RemoteEndpointAwareJdkSSLOptions sslOptions = new RemoteEndpointAwareJdkSSLOptions(sslContext, encryptionOptions.cipherSuitesArray())
             {
+                @Override
                 protected SSLEngine newSSLEngine(SocketChannel channel, InetSocketAddress remoteEndpoint)
                 {
                     SSLEngine engine = super.newSSLEngine(channel, remoteEndpoint);