diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 7561425dc9..5775e6c641 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -953,11 +953,15 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
 
         <listitem><para>Controls the secure bits set for the executed process. Takes a space-separated combination of
         options from the following list: <option>keep-caps</option>, <option>keep-caps-locked</option>,
-        <option>no-setuid-fixup</option>, <option>no-setuid-fixup-locked</option>, <option>noroot</option>, and
-        <option>noroot-locked</option>. This option may appear more than once, in which case the secure bits are
+        <option>no-setuid-fixup</option>, <option>no-setuid-fixup-locked</option>, <option>noroot</option>,
+        <option>noroot-locked</option>, <option>no-cap-ambient-raise</option>, <option>no-cap-ambient-raise-locked</option>,
+        <option>exec-restrict-file</option>, <option>exec-restrict-file-locked</option>,
+        <option>exec-deny-interactive</option>, and <option>exec-deny-interactive-locked</option>.
+        This option may appear more than once, in which case the secure bits are
         ORed. If the empty string is assigned to this option, the bits are reset to 0. This does not affect commands
         prefixed with <literal>+</literal>. See <citerefentry
-        project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
+        project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+        and <ulink url="https://docs.kernel.org/userspace-api/check_exec.html">Executability check</ulink> for
         details.</para></listitem>
       </varlistentry>
 
diff --git a/src/shared/securebits-util.c b/src/shared/securebits-util.c
index bd682e6cbe..ec613f89bc 100644
--- a/src/shared/securebits-util.c
+++ b/src/shared/securebits-util.c
@@ -22,6 +22,18 @@ static inline const char* secure_bit_to_string(int i) {
                         return "noroot";
                 case SECURE_NOROOT_LOCKED:
                         return "noroot-locked";
+                case SECURE_NO_CAP_AMBIENT_RAISE:
+                        return "no-cap-ambient-raise";
+                case SECURE_NO_CAP_AMBIENT_RAISE_LOCKED:
+                        return "no-cap-ambient-raise-locked";
+                case SECURE_EXEC_RESTRICT_FILE:
+                        return "exec-restrict-file";
+                case SECURE_EXEC_RESTRICT_FILE_LOCKED:
+                        return "exec-restrict-file-locked";
+                case SECURE_EXEC_DENY_INTERACTIVE:
+                        return "exec-deny-interactive";
+                case SECURE_EXEC_DENY_INTERACTIVE_LOCKED:
+                        return "exec-deny-interactive-locked";
                 default:
                         assert_not_reached();
         }
@@ -55,6 +67,12 @@ int secure_bits_to_strv(int i, char ***ret) {
                 SECURE_NO_SETUID_FIXUP_LOCKED,
                 SECURE_NOROOT,
                 SECURE_NOROOT_LOCKED,
+                SECURE_NO_CAP_AMBIENT_RAISE,
+                SECURE_NO_CAP_AMBIENT_RAISE_LOCKED,
+                SECURE_EXEC_RESTRICT_FILE,
+                SECURE_EXEC_RESTRICT_FILE_LOCKED,
+                SECURE_EXEC_DENY_INTERACTIVE,
+                SECURE_EXEC_DENY_INTERACTIVE_LOCKED,
         };
         int r;
 
@@ -98,6 +116,18 @@ int secure_bits_from_string(const char *s) {
                         secure_bits |= 1 << SECURE_NOROOT;
                 else if (streq(word, "noroot-locked"))
                         secure_bits |= 1 << SECURE_NOROOT_LOCKED;
+                else if (streq(word, "no-cap-ambient-raise"))
+                        secure_bits |= 1 << SECURE_NO_CAP_AMBIENT_RAISE;
+                else if (streq(word, "no-cap-ambient-raise-locked"))
+                        secure_bits |= 1 << SECURE_NO_CAP_AMBIENT_RAISE_LOCKED;
+                else if (streq(word, "exec-restrict-file"))
+                        secure_bits |= 1 << SECURE_EXEC_RESTRICT_FILE;
+                else if (streq(word, "exec-restrict-file-locked"))
+                        secure_bits |= 1 << SECURE_EXEC_RESTRICT_FILE_LOCKED;
+                else if (streq(word, "exec-deny-interactive"))
+                        secure_bits |= 1 << SECURE_EXEC_DENY_INTERACTIVE;
+                else if (streq(word, "exec-deny-interactive-locked"))
+                        secure_bits |= 1 << SECURE_EXEC_DENY_INTERACTIVE_LOCKED;
         }
 
         return secure_bits;
diff --git a/src/test/test-secure-bits.c b/src/test/test-secure-bits.c
index d217876e2c..5bf6431048 100644
--- a/src/test/test-secure-bits.c
+++ b/src/test/test-secure-bits.c
@@ -11,6 +11,12 @@ static const char * const string_bits[] = {
         "no-setuid-fixup-locked",
         "noroot",
         "noroot-locked",
+        "no-cap-ambient-raise",
+        "no-cap-ambient-raise-locked",
+        "exec-restrict-file",
+        "exec-restrict-file-locked",
+        "exec-deny-interactive",
+        "exec-deny-interactive-locked",
         NULL
 };