diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c
--- a/sys/kern/kern_environment.c
+++ b/sys/kern/kern_environment.c
@@ -113,12 +113,13 @@
 
 	switch (uap->what) {
 	case KENV_SET:
-		error = caps_priv_check_self(SYSCAP_NOKENV_WR);
-		if (error)
-			return (error);
-		break;
-
 	case KENV_UNSET:
+	case KENV_GET:
+		/*
+		 * The kernel environment (dynamic + boot) can hold
+		 * loader.conf secrets (passwords, keys); restrict both
+		 * reads and writes to privileged users.
+		 */
 		error = caps_priv_check_self(SYSCAP_NOKENV_WR);
 		if (error)
 			return (error);
@@ -477,6 +478,11 @@
 	char	*cp;
 	int	i, error;
 
+	/* Defense-in-depth: boot env may hold loader.conf secrets. */
+	error = caps_priv_check_self(SYSCAP_NOKENV_WR);
+	if (error)
+		return (error);
+
 	if (kern_envp == NULL)
 		return(ENOENT);