diff --git a/.pick_status.json b/.pick_status.json
index 5c587d88974..dad408d80d3 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -34,7 +34,7 @@
         "description": "util/disk_cache: Use secure_getenv to determine cache directories",
         "nominated": true,
         "nomination_type": 0,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": null,
         "notes": null
diff --git a/src/util/disk_cache_os.c b/src/util/disk_cache_os.c
index d8bd8a0f532..bdc715cd06d 100644
--- a/src/util/disk_cache_os.c
+++ b/src/util/disk_cache_os.c
@@ -891,10 +891,10 @@ disk_cache_generate_cache_dir(void *mem_ctx, const char *gpu_name,
    else if (cache_type == DISK_CACHE_DATABASE)
       cache_dir_name = CACHE_DIR_NAME_DB;
 
-   char *path = getenv("MESA_SHADER_CACHE_DIR");
+   char *path = secure_getenv("MESA_SHADER_CACHE_DIR");
 
    if (!path) {
-      path = getenv("MESA_GLSL_CACHE_DIR");
+      path = secure_getenv("MESA_GLSL_CACHE_DIR");
       if (path)
          fprintf(stderr,
                  "*** MESA_GLSL_CACHE_DIR is deprecated; "
@@ -911,7 +911,7 @@ disk_cache_generate_cache_dir(void *mem_ctx, const char *gpu_name,
    }
 
    if (path == NULL) {
-      char *xdg_cache_home = getenv("XDG_CACHE_HOME");
+      char *xdg_cache_home = secure_getenv("XDG_CACHE_HOME");
 
       if (xdg_cache_home) {
          if (mkdir_if_needed(xdg_cache_home) == -1)