diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 7001acb8d..dddc5d1fa 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -6,6 +6,7 @@ This release of fish introduces the following small enhancements:
 - Cursor shaping for Vi mode is enabled by default in tmux, and will be used if the outer terminal is capable (:issue:`8981`).
 - ``printf`` returns a better error when used with arguments interpreted as octal numbers (:issue:`9035`).
 - New completions for ``qdbus`` (:issue:`9031:`) and ``reflector`` (:issue:`9027`), and improvements to some completions.
+- ``history merge`` when in private mode is now an error, rather than wiping out other sessions' history (:issue:`9050`).
 
 This release also fixes a number of problems identified in fish 3.5.0.
 
diff --git a/src/builtins/history.cpp b/src/builtins/history.cpp
index e6b6bbe43..2f43cc5c4 100644
--- a/src/builtins/history.cpp
+++ b/src/builtins/history.cpp
@@ -305,6 +305,12 @@ maybe_t<int> builtin_history(parser_t &parser, io_streams_t &streams, const wcha
                 break;
             }
 
+            if (in_private_mode(parser.vars())) {
+                streams.err.append_format(
+                                          _(L"%ls: can't merge history in private mode\n"), cmd);
+                status = STATUS_INVALID_ARGS;
+                break;
+            }
             history->incorporate_external_changes();
             break;
         }
diff --git a/tests/checks/history.fish b/tests/checks/history.fish
index 7afe35b60..53a62d463 100644
--- a/tests/checks/history.fish
+++ b/tests/checks/history.fish
@@ -66,3 +66,7 @@ builtin history -t merge
 # Now do a history command that should succeed so we exit with a zero,
 # success, status.
 builtin history save
+
+set -g fish_private_mode 1
+builtin history merge
+#CHECKERR: history: can't merge history in private mode