diff --git a/src/conf/secret_conf.c b/src/conf/secret_conf.c
index ef6a4b606e..1dee90eba1 100644
--- a/src/conf/secret_conf.c
+++ b/src/conf/secret_conf.c
@@ -191,12 +191,14 @@ secretXMLParseNode(xmlDocPtr xml, xmlNodePtr root)
 
 static virSecretDef *
 virSecretDefParse(const char *xmlStr,
-                  const char *filename)
+                  const char *filename,
+                  unsigned int flags)
 {
     g_autoptr(xmlDoc) xml = NULL;
     virSecretDef *ret = NULL;
 
-    if ((xml = virXMLParse(filename, xmlStr, _("(definition_of_secret)"), NULL, false))) {
+    if ((xml = virXMLParse(filename, xmlStr, _("(definition_of_secret)"), "secret.rng",
+                           flags & VIR_SECRET_DEFINE_VALIDATE))) {
         ret = secretXMLParseNode(xml, xmlDocGetRootElement(xml));
     }
 
@@ -204,15 +206,16 @@ virSecretDefParse(const char *xmlStr,
 }
 
 virSecretDef *
-virSecretDefParseString(const char *xmlStr)
+virSecretDefParseString(const char *xmlStr,
+                        unsigned int flags)
 {
-    return virSecretDefParse(xmlStr, NULL);
+    return virSecretDefParse(xmlStr, NULL, flags);
 }
 
 virSecretDef *
 virSecretDefParseFile(const char *filename)
 {
-    return virSecretDefParse(NULL, filename);
+    return virSecretDefParse(NULL, filename, 0);
 }
 
 static int
diff --git a/src/conf/secret_conf.h b/src/conf/secret_conf.h
index 373c96b729..36d50407fd 100644
--- a/src/conf/secret_conf.h
+++ b/src/conf/secret_conf.h
@@ -35,7 +35,7 @@ struct _virSecretDef {
 void virSecretDefFree(virSecretDef *def);
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(virSecretDef, virSecretDefFree);
 
-virSecretDef *virSecretDefParseString(const char *xml);
+virSecretDef *virSecretDefParseString(const char *xml, unsigned int flags);
 virSecretDef *virSecretDefParseFile(const char *filename);
 char *virSecretDefFormat(const virSecretDef *def);
 
diff --git a/src/secret/secret_driver.c b/src/secret/secret_driver.c
index d2175de8ed..6b3f0711aa 100644
--- a/src/secret/secret_driver.c
+++ b/src/secret/secret_driver.c
@@ -222,7 +222,7 @@ secretDefineXML(virConnectPtr conn,
 
     virCheckFlags(0, NULL);
 
-    if (!(def = virSecretDefParseString(xml)))
+    if (!(def = virSecretDefParseString(xml, 0)))
         return NULL;
 
     if (virSecretDefineXMLEnsureACL(conn, def) < 0)