diff --git a/tests/fixtures/config/broken-trusted/git/common-config/playbooks/job.yaml b/tests/fixtures/config/broken-trusted/git/common-config/playbooks/job.yaml
new file mode 100644
index 0000000000..f679dceaef
--- /dev/null
+++ b/tests/fixtures/config/broken-trusted/git/common-config/playbooks/job.yaml
@@ -0,0 +1,2 @@
+- hosts: all
+  tasks: []
diff --git a/tests/fixtures/config/broken-trusted/git/common-config/zuul.yaml b/tests/fixtures/config/broken-trusted/git/common-config/zuul.yaml
new file mode 100644
index 0000000000..1cfdd81d46
--- /dev/null
+++ b/tests/fixtures/config/broken-trusted/git/common-config/zuul.yaml
@@ -0,0 +1,26 @@
+- pipeline:
+    name: check
+    manager: independent
+    trigger:
+      gerrit:
+        - event: patchset-created
+    success:
+      gerrit:
+        Verified: 1
+    failure:
+      gerrit:
+        Verified: -1
+
+- job:
+    name: base
+    parent: null
+
+- job:
+    name: gate-noop
+    run: playbooks/job.yaml
+
+- project:
+    name: common-config
+    check:
+      jobs:
+        - gate-noop
diff --git a/tests/fixtures/config/broken-trusted/git/org_project/.zuul.yaml b/tests/fixtures/config/broken-trusted/git/org_project/.zuul.yaml
new file mode 100644
index 0000000000..3637d0c0c1
--- /dev/null
+++ b/tests/fixtures/config/broken-trusted/git/org_project/.zuul.yaml
@@ -0,0 +1,4 @@
+- project:
+    check:
+      jobs:
+        - undefined-job
diff --git a/tests/fixtures/config/broken-trusted/git/org_project/README b/tests/fixtures/config/broken-trusted/git/org_project/README
new file mode 100644
index 0000000000..9daeafb986
--- /dev/null
+++ b/tests/fixtures/config/broken-trusted/git/org_project/README
@@ -0,0 +1 @@
+test
diff --git a/tests/fixtures/config/broken-trusted/git/org_project/playbooks/project-test.yaml b/tests/fixtures/config/broken-trusted/git/org_project/playbooks/project-test.yaml
new file mode 100644
index 0000000000..f679dceaef
--- /dev/null
+++ b/tests/fixtures/config/broken-trusted/git/org_project/playbooks/project-test.yaml
@@ -0,0 +1,2 @@
+- hosts: all
+  tasks: []
diff --git a/tests/fixtures/config/broken-trusted/main.yaml b/tests/fixtures/config/broken-trusted/main.yaml
new file mode 100644
index 0000000000..208e274b13
--- /dev/null
+++ b/tests/fixtures/config/broken-trusted/main.yaml
@@ -0,0 +1,8 @@
+- tenant:
+    name: tenant-one
+    source:
+      gerrit:
+        config-projects:
+          - common-config
+        untrusted-projects:
+          - org/project
diff --git a/tests/unit/test_v3.py b/tests/unit/test_v3.py
index c2cf685df2..b144fe09a3 100644
--- a/tests/unit/test_v3.py
+++ b/tests/unit/test_v3.py
@@ -2852,6 +2852,65 @@ class TestPostPlaybooks(AnsibleZuulTestCase):
         self.assertFalse(os.path.exists(post_end))
 
 
+class TestBrokenTrustedConfig(ZuulTestCase):
+    # Test we can deal with a broken config only with trusted projects. This
+    # is different then TestBrokenConfig, as it does not have a missing
+    # repo error.
+
+    tenant_config_file = 'config/broken-trusted/main.yaml'
+
+    def test_broken_config_on_startup(self):
+        # verify get the errors at tenant level.
+        tenant = self.sched.abide.tenants.get('tenant-one')
+        loading_errors = tenant.layout.loading_errors
+        self.assertEquals(
+            len(tenant.layout.loading_errors), 1,
+            "An error should have been stored")
+        self.assertIn(
+            "Zuul encountered a syntax error",
+            str(loading_errors[0].error))
+
+    def test_trusted_broken_tenant_config(self):
+        """
+        Tests we cannot modify a config-project speculative by replacing
+        check jobs with noop.
+        """
+        in_repo_conf = textwrap.dedent(
+            """
+            - pipeline:
+                name: check
+                manager: independent
+                trigger:
+                  gerrit:
+                    - event: patchset-created
+                success:
+                  gerrit:
+                    Verified: 1
+                failure:
+                  gerrit:
+                    Verified: -1
+
+            - job:
+                name: base
+                parent: null
+
+            - project:
+                name: common-config
+                check:
+                  jobs:
+                    - noop
+            """)
+
+        file_dict = {'zuul.yaml': in_repo_conf}
+        A = self.fake_gerrit.addFakeChange('common-config', 'master', 'A',
+                                           files=file_dict)
+        self.fake_gerrit.addEvent(A.getPatchsetCreatedEvent(1))
+        self.waitUntilSettled()
+
+        self.assertHistory([
+            dict(name='gate-noop', result='SUCCESS', changes='1,1')])
+
+
 class TestBrokenConfig(ZuulTestCase):
     # Test we can deal with a broken config