diff --git a/contrib/amcheck/expected/check_btree.out b/contrib/amcheck/expected/check_btree.out
index e7fb5f55157..bab1fda69ac 100644
--- a/contrib/amcheck/expected/check_btree.out
+++ b/contrib/amcheck/expected/check_btree.out
@@ -178,7 +178,8 @@ SELECT bt_index_check('toasty', true);
 (1 row)
 
 --
--- Check that index expressions and predicates are run as the table's owner
+-- Check that index expressions and predicates are run as the table's owner,
+-- with empty search_path
 --
 TRUNCATE bttest_a;
 INSERT INTO bttest_a SELECT * FROM generate_series(1, 1000);
@@ -186,19 +187,31 @@ ALTER TABLE bttest_a OWNER TO regress_bttest_role;
 -- A dummy index function checking current_user
 CREATE FUNCTION ifun(int8) RETURNS int8 AS $$
 BEGIN
-	ASSERT current_user = 'regress_bttest_role',
+	ASSERT current_setting('search_path') = 'pg_catalog, pg_temp',
+		format('ifun(%s) called with current_schemas %s, search_path %s',
+			$1, current_schemas(true), current_setting('search_path'));
+	ASSERT "current_user"() = 'regress_bttest_role',
 		format('ifun(%s) called by %s', $1, current_user);
 	RETURN $1;
 END;
 $$ LANGUAGE plpgsql IMMUTABLE;
 CREATE INDEX bttest_a_expr_idx ON bttest_a ((ifun(id) + ifun(0)))
 	WHERE ifun(id + 10) > ifun(10);
+BEGIN;
+SET LOCAL check_function_bodies = off;
+CREATE SCHEMA preempt;
+GRANT USAGE ON SCHEMA preempt TO regress_bttest_role;
+SET LOCAL search_path = preempt, pg_catalog, public;
+CREATE FUNCTION "current_user"() RETURNS name AS $$
+	broken
+$$ LANGUAGE sql STABLE PARALLEL SAFE STRICT;
 SELECT bt_index_check('bttest_a_expr_idx', true);
  bt_index_check 
 ----------------
  
 (1 row)
 
+ROLLBACK;
 -- UNIQUE constraint check
 SELECT bt_index_check('bttest_a_idx', heapallindexed => true, checkunique => true);
  bt_index_check 
diff --git a/contrib/amcheck/sql/check_btree.sql b/contrib/amcheck/sql/check_btree.sql
index 0793dbfeebd..9bd484b92a6 100644
--- a/contrib/amcheck/sql/check_btree.sql
+++ b/contrib/amcheck/sql/check_btree.sql
@@ -116,7 +116,8 @@ INSERT INTO toast_bug SELECT repeat('a', 2200);
 SELECT bt_index_check('toasty', true);
 
 --
--- Check that index expressions and predicates are run as the table's owner
+-- Check that index expressions and predicates are run as the table's owner,
+-- with empty search_path
 --
 TRUNCATE bttest_a;
 INSERT INTO bttest_a SELECT * FROM generate_series(1, 1000);
@@ -124,7 +125,10 @@ ALTER TABLE bttest_a OWNER TO regress_bttest_role;
 -- A dummy index function checking current_user
 CREATE FUNCTION ifun(int8) RETURNS int8 AS $$
 BEGIN
-	ASSERT current_user = 'regress_bttest_role',
+	ASSERT current_setting('search_path') = 'pg_catalog, pg_temp',
+		format('ifun(%s) called with current_schemas %s, search_path %s',
+			$1, current_schemas(true), current_setting('search_path'));
+	ASSERT "current_user"() = 'regress_bttest_role',
 		format('ifun(%s) called by %s', $1, current_user);
 	RETURN $1;
 END;
@@ -132,8 +136,16 @@ $$ LANGUAGE plpgsql IMMUTABLE;
 
 CREATE INDEX bttest_a_expr_idx ON bttest_a ((ifun(id) + ifun(0)))
 	WHERE ifun(id + 10) > ifun(10);
-
+BEGIN;
+SET LOCAL check_function_bodies = off;
+CREATE SCHEMA preempt;
+GRANT USAGE ON SCHEMA preempt TO regress_bttest_role;
+SET LOCAL search_path = preempt, pg_catalog, public;
+CREATE FUNCTION "current_user"() RETURNS name AS $$
+	broken
+$$ LANGUAGE sql STABLE PARALLEL SAFE STRICT;
 SELECT bt_index_check('bttest_a_expr_idx', true);
+ROLLBACK;
 
 -- UNIQUE constraint check
 SELECT bt_index_check('bttest_a_idx', heapallindexed => true, checkunique => true);
diff --git a/src/backend/utils/init/usercontext.c b/src/backend/utils/init/usercontext.c
index 9772420e3c2..e15b86e4997 100644
--- a/src/backend/utils/init/usercontext.c
+++ b/src/backend/utils/init/usercontext.c
@@ -70,6 +70,12 @@ SwitchToUntrustedUser(Oid userid, UserContext *context)
 		 * session state. Also set up a new GUC nest level, so that we can
 		 * roll back any GUC changes that may be made by code running as the
 		 * target user, inasmuch as they could be malicious.
+		 *
+		 * Unlike most use of SECURITY_RESTRICTED_OPERATION, this opts not to
+		 * use RestrictSearchPath().  Calling it would just stop the current
+		 * user from attacking "userid", but we've already established that
+		 * the current user could just SET ROLE to "userid".  Calling it would
+		 * be a compatibility break.
 		 */
 		sec_context |= SECURITY_RESTRICTED_OPERATION;
 		SetUserIdAndSecContext(userid, sec_context);