diff --git a/changes/bug21407 b/changes/bug21407
new file mode 100644
index 0000000000..8d0d917439
--- /dev/null
+++ b/changes/bug21407
@@ -0,0 +1,4 @@
+  o Minor features (defaults, security):
+    - The default value for UseCreateFast is now 0: clients which haven't yet
+      received a consensus document will nonetheless use a proper handshake
+      to talk to their directory servers (when they can). Closes ticket 21407.
diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index 79962e8dbb..14e829b03e 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -819,7 +819,7 @@ should_use_create_fast_for_circuit(origin_circuit_t *circ)
   }
   if (options->FastFirstHopPK == -1) {
     /* option is "auto", so look at the consensus. */
-    return networkstatus_get_param(NULL, "usecreatefast", 1, 0, 1);
+    return networkstatus_get_param(NULL, "usecreatefast", 0, 0, 1);
   }
 
   return options->FastFirstHopPK;