diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index dfe48e1..09175d4 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -7,7 +7,7 @@ jobs:
 
     strategy:
       matrix:
-        os: ['ubuntu-22.04']
+        os: ['ubuntu-24.04']
         python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
 
     runs-on: ${{ matrix.os }}
diff --git a/tests/test_xkb.py b/tests/test_xkb.py
index 4c46e2b..3a8294d 100644
--- a/tests/test_xkb.py
+++ b/tests/test_xkb.py
@@ -59,6 +59,13 @@ def tearDownClass(cls):
     def test_create(self):
         xkb.Context()
 
+    def test_no_secure_getenv(self):
+        # We are unlikely to be testing in an environment where
+        # secure_getenv() will return NULL instead of a value string,
+        # so just check that we are able to create a context with this
+        # flag set
+        xkb.Context(no_secure_getenv=True)
+
     def test_default_includes(self):
         ctx = xkb.Context(no_default_includes=True)
         self.assertEqual(len(list(ctx.include_path())), 0)
diff --git a/xkbcommon/ffi_build.py b/xkbcommon/ffi_build.py
index c222655..99fce31 100644
--- a/xkbcommon/ffi_build.py
+++ b/xkbcommon/ffi_build.py
@@ -96,7 +96,8 @@
 enum xkb_context_flags {
     XKB_CONTEXT_NO_FLAGS = ...,
     XKB_CONTEXT_NO_DEFAULT_INCLUDES = ...,
-    XKB_CONTEXT_NO_ENVIRONMENT_NAMES = ...
+    XKB_CONTEXT_NO_ENVIRONMENT_NAMES = ...,
+    XKB_CONTEXT_NO_SECURE_GETENV = ...
 };
 
 struct xkb_context *
diff --git a/xkbcommon/xkb.py b/xkbcommon/xkb.py
index 8de19af..afa7362 100644
--- a/xkbcommon/xkb.py
+++ b/xkbcommon/xkb.py
@@ -229,7 +229,8 @@ class Context:
     XKB_DEFAULT_OPTIONS - see xkb_rule_names.
     """
 
-    def __init__(self, no_default_includes=False, no_environment_names=False):
+    def __init__(self, no_default_includes=False, no_environment_names=False,
+                 no_secure_getenv=False):
         """Create a new context.
 
         Keyword arguments:
@@ -239,12 +240,17 @@ def __init__(self, no_default_includes=False, no_environment_names=False):
 
         no_environment_names: if set, don't take RMLVO names from the
         environment.
+
+        no_secure_getenv: if set, use getenv() instead of
+        secure_getenv() to obtain environment variables.
         """
         flags = lib.XKB_CONTEXT_NO_FLAGS
         if no_default_includes:
             flags = flags | lib.XKB_CONTEXT_NO_DEFAULT_INCLUDES
         if no_environment_names:
             flags = flags | lib.XKB_CONTEXT_NO_ENVIRONMENT_NAMES
+        if no_secure_getenv:
+            flags = flags | lib.XKB_CONTEXT_NO_SECURE_GETENV
         context = lib.xkb_context_new(flags)
         if not context:
             raise XKBError("Couldn't create XKB context")