diff --git a/lib/tasks/version_bump.rake b/lib/tasks/version_bump.rake
index 76cc7d1db8c..6953ffc588b 100644
--- a/lib/tasks/version_bump.rake
+++ b/lib/tasks/version_bump.rake
@@ -406,11 +406,7 @@ task "version_bump:stage_security_fixes", [:base] do |t, args|
       git "fetch", origin, origin_branch
 
       first_commit_on_branch = git("log", "--format=%H", "origin/#{base}..#{ref}").lines.last.strip
-      author = git("log", "-n", "1", "--format=%an <%ae>", first_commit_on_branch).strip
-      message = git("log", "-n", "1", "--format=%B", first_commit_on_branch).strip
-
-      git "merge", "--squash", ref
-      git "commit", "--author", author, "-m", message
+      git "cherry-pick", "#{first_commit_on_branch}^..#{ref}"
     end
 
     puts "Finished merging commits into a locally-staged #{branch} branch. Git log is:"
diff --git a/spec/tasks/version_bump_spec.rb b/spec/tasks/version_bump_spec.rb
index b40cc63fccb..23aeedddc70 100644
--- a/spec/tasks/version_bump_spec.rb
+++ b/spec/tasks/version_bump_spec.rb
@@ -213,7 +213,12 @@ RSpec.describe "tasks/version_bump" do
     Dir.chdir(origin_path) do
       # Check each fix has been added as a single commit, with the message matching the first commit on the branch
       expect(run("git", "log", "--pretty=%s", "main").lines.map(&:strip)).to eq(
-        ["security fix two", "security fix one, commit one", "Initial commit"],
+        [
+          "security fix two",
+          "security fix one, commit two",
+          "security fix one, commit one",
+          "Initial commit",
+        ],
       )
 
       # Check all the files from both fixes are present