diff --git a/include/mimalloc-types.h b/include/mimalloc-types.h
index 12a420c2..35bb1502 100644
--- a/include/mimalloc-types.h
+++ b/include/mimalloc-types.h
@@ -33,7 +33,7 @@ terms of the MIT license. A copy of the license can be found in the file
 // #define MI_SECURE 4  // checks for double free. (may be more expensive)
 
 #if !defined(MI_SECURE)
-#define MI_SECURE 0
+#define MI_SECURE 4
 #endif
 
 // Define MI_DEBUG for debug mode
diff --git a/src/arena.c b/src/arena.c
index c12e60a1..85d5fd3f 100644
--- a/src/arena.c
+++ b/src/arena.c
@@ -210,7 +210,7 @@ static void mi_cache_purge(mi_os_tld_t* tld) {
         if (slot->expire != 0 && now >= slot->expire) {  // safe read
           // still expired, decommit it
           slot->expire = 0;
-          mi_assert_internal(slot->is_committed && !slot->is_large);
+          mi_assert_internal(slot->is_committed && mi_bitmap_is_claimed(cache_available_large, MI_CACHE_FIELDS, 1, bitidx));
           _mi_abandoned_await_readers();  // wait until safe to decommit
           _mi_os_decommit(slot->p, MI_SEGMENT_SIZE, tld->stats);
           slot->is_committed = false;
diff --git a/src/segment.c b/src/segment.c
index 6728ef3b..4d9d6809 100644
--- a/src/segment.c
+++ b/src/segment.c
@@ -273,7 +273,12 @@ static void mi_segment_os_free(mi_segment_t* segment, mi_segments_tld_t* tld) {
   mi_segment_map_freed_at(segment);
   mi_segments_track_size(-((long)mi_segment_size(segment)),tld);
   if (MI_SECURE>0) {
-    _mi_os_unprotect(segment, mi_segment_size(segment)); // ensure no more guard pages are set
+    // _mi_os_unprotect(segment, mi_segment_size(segment)); // ensure no more guard pages are set
+    // unprotect the guard pages; we cannot just unprotect the whole segment size as part may be decommitted
+    size_t os_page_size = _mi_os_page_size();
+    _mi_os_unprotect((uint8_t*)segment + mi_segment_info_size(segment) - os_page_size, os_page_size);
+    uint8_t* end = (uint8_t*)segment + mi_segment_size(segment) - os_page_size;
+    _mi_os_unprotect(end, os_page_size);
   }
 
   // purge delayed decommits now? (no, leave it to the cache)