diff --git a/packaging/tests/tas-restapi/src/test/java/org/alfresco/rest/rules/ReorderRules.java b/packaging/tests/tas-restapi/src/test/java/org/alfresco/rest/rules/ReorderRules.java
index dcf9c9230e..b531da50da 100644
--- a/packaging/tests/tas-restapi/src/test/java/org/alfresco/rest/rules/ReorderRules.java
+++ b/packaging/tests/tas-restapi/src/test/java/org/alfresco/rest/rules/ReorderRules.java
@@ -27,7 +27,7 @@ package org.alfresco.rest.rules;
 
 import static java.util.stream.Collectors.toList;
 
-import static org.alfresco.rest.rules.RulesTestsUtils.createRuleModel;
+import static org.alfresco.rest.rules.RulesTestsUtils.createRuleModelWithDefaultValues;
 import static org.alfresco.utility.report.log.Step.STEP;
 import static org.springframework.http.HttpStatus.FORBIDDEN;
 import static org.springframework.http.HttpStatus.OK;
@@ -161,13 +161,13 @@ public class ReorderRules extends RestTest
         RestRuleSetModel ruleSetBody = new RestRuleSetModel();
         ruleSetBody.setId("-default-");
         ruleSetBody.setRuleIds(reversedRuleIds);
-        RestRuleSetModel ruleSet = restClient.authenticateUser(user).withCoreAPI().usingNode(ruleFolder)
-                                             .include("ruleIds").updateRuleSet(ruleSetBody);
+        restClient.authenticateUser(user).withCoreAPI().usingNode(ruleFolder)
+                  .include("ruleIds").updateRuleSet(ruleSetBody);
 
         restClient.assertStatusCodeIs(FORBIDDEN);
     }
 
-    /** Check that a user cannot reorder the rules in a rule set if they only have read permission. */
+    /** Check that a user can reorder the rules in a rule set if they have write permission. */
     @Test
     public void reorderRulesWithPermission()
     {
@@ -197,7 +197,7 @@ public class ReorderRules extends RestTest
     {
         return IntStream.range(0, 3).mapToObj(index ->
         {
-            RestRuleModel ruleModel = createRuleModel("ruleName");
+            RestRuleModel ruleModel = createRuleModelWithDefaultValues();
             return restClient.authenticateUser(user).withCoreAPI().usingNode(folder).usingDefaultRuleSet().createSingleRule(ruleModel);
         }).collect(toList());
     }
diff --git a/remote-api/src/main/java/org/alfresco/rest/api/impl/rules/RuleSetsImpl.java b/remote-api/src/main/java/org/alfresco/rest/api/impl/rules/RuleSetsImpl.java
index 0f4ea936c9..8b162290ca 100644
--- a/remote-api/src/main/java/org/alfresco/rest/api/impl/rules/RuleSetsImpl.java
+++ b/remote-api/src/main/java/org/alfresco/rest/api/impl/rules/RuleSetsImpl.java
@@ -103,7 +103,7 @@ public class RuleSetsImpl implements RuleSets
 
             // Check that the set of rule ids hasn't changed.
             Set<String> existingRuleIds = new HashSet<>(ruleSetLoader.loadRuleIds(folderNode));
-            if (!suppliedRuleIdSet.equals(existingRuleIds))
+            if (suppliedRuleIdSet.size() != suppliedRuleIds.size() || !suppliedRuleIdSet.equals(existingRuleIds))
             {
                 throw new InvalidArgumentException("Unexpected set of rule ids - received " + suppliedRuleIds + " but expected " + existingRuleIds);
             }
diff --git a/remote-api/src/test/java/org/alfresco/rest/api/impl/rules/RuleSetsImplTest.java b/remote-api/src/test/java/org/alfresco/rest/api/impl/rules/RuleSetsImplTest.java
index 904a312be3..a53dac2e87 100644
--- a/remote-api/src/test/java/org/alfresco/rest/api/impl/rules/RuleSetsImplTest.java
+++ b/remote-api/src/test/java/org/alfresco/rest/api/impl/rules/RuleSetsImplTest.java
@@ -402,6 +402,30 @@ public class RuleSetsImplTest extends TestCase
         );
     }
 
+    /** Check that we can't include a rule twice in a rule set. */
+    @Test
+    public void testUpdateRuleSet_DuplicateRuleId()
+    {
+        List<String> dbOrder = List.of("RuleA", "RuleB");
+        List<String> newOrder = List.of("RuleA", "RuleB", "RuleA");
+        List<String> includes = List.of(RULE_IDS);
+
+        RuleSet dbRuleSet = mock(RuleSet.class);
+        RuleSet requestRuleSet = mock(RuleSet.class);
+        given(requestRuleSet.getId()).willReturn(RULE_SET_ID);
+        given(requestRuleSet.getRuleIds()).willReturn(newOrder);
+
+        given(ruleSetLoaderMock.loadRuleSet(RULE_SET_NODE, FOLDER_NODE, includes)).willReturn(dbRuleSet);
+        given(ruleSetLoaderMock.loadRuleIds(FOLDER_NODE)).willReturn(dbOrder);
+        given(nodeValidatorMock.validateFolderNode(FOLDER_ID, false)).willReturn(FOLDER_NODE);
+        given(nodeValidatorMock.validateRuleSetNode(RULE_SET_ID, FOLDER_NODE)).willReturn(RULE_SET_NODE);
+
+        //when
+        assertThatExceptionOfType(InvalidArgumentException.class).isThrownBy(
+                () -> ruleSets.updateRuleSet(FOLDER_ID, requestRuleSet, includes)
+                                                                            );
+    }
+
     /** Check that we can update the rule ids without returning them. */
     @Test
     public void testUpdateRuleSet_dontIncludeRuleIds()