diff --git a/java/com/google/gerrit/server/IdentifiedUser.java b/java/com/google/gerrit/server/IdentifiedUser.java
index b007fc0f26..6dfdfe1bd0 100644
--- a/java/com/google/gerrit/server/IdentifiedUser.java
+++ b/java/com/google/gerrit/server/IdentifiedUser.java
@@ -325,12 +325,12 @@ public class IdentifiedUser extends CurrentUser {
     return false;
   }
 
-  public Set<String> getEmailAddresses() {
+  public ImmutableSet<String> getEmailAddresses() {
     if (!loadedAllEmails) {
       validEmails.addAll(realm.getEmailAddresses(this));
       loadedAllEmails = true;
     }
-    return validEmails;
+    return ImmutableSet.copyOf(validEmails);
   }
 
   public String getName() {