diff --git a/src/os.c b/src/os.c
index 824efec1..a7cc3cab 100644
--- a/src/os.c
+++ b/src/os.c
@@ -917,12 +917,12 @@ static bool mi_os_commitx(void* addr, size_t size, bool commit, bool conservativ
     if (err != 0) { err = errno; }
   } 
   else {
-    #if defined(MADV_DONTNEED)
+    #if defined(MADV_DONTNEED) && MI_DEBUG == 0 && MI_SECURE == 0
     // decommit: use MADV_DONTNEED as it decreases rss immediately (unlike MADV_FREE)
     // (on the other hand, MADV_FREE would be good enough.. it is just not reflected in the stats :-( )
     err = madvise(start, csize, MADV_DONTNEED);
     #else
-    // decommit: just disable access
+    // decommit: just disable access (also used in debug and secure mode to trap on illegal access)
     err = mprotect(start, csize, PROT_NONE);
     if (err != 0) { err = errno; }
     #endif