diff --git a/dlls/secur32/tests/secur32.c b/dlls/secur32/tests/secur32.c
index 2d2c2a69255..8fd421ca732 100644
--- a/dlls/secur32/tests/secur32.c
+++ b/dlls/secur32/tests/secur32.c
@@ -440,7 +440,9 @@ static void test_kerberos(void)
         | SECPKG_FLAG_READONLY_WITH_CHECKSUM;
     static const ULONG optional_mask =
           SECPKG_FLAG_RESTRICTED_TOKENS
-        | SECPKG_FLAG_APPCONTAINER_CHECKS;
+        | SECPKG_FLAG_APPCONTAINER_CHECKS
+        | 0x02000000; /* not defined in the SDK */
+
 
     status = QuerySecurityPackageInfoA(provider, &info);
     ok(status == SEC_E_OK, "Kerberos package not installed, skipping test\n");
diff --git a/include/sspi.h b/include/sspi.h
index 0e248fbef05..ad423eed90c 100644
--- a/include/sspi.h
+++ b/include/sspi.h
@@ -171,8 +171,9 @@ SECURITY_STATUS WINAPI AddSecurityPackageW(LPWSTR,SECURITY_PACKAGE_OPTIONS*);
 #define SECPKG_FLAG_RESTRICTED_TOKENS      0x00080000
 #define SECPKG_FLAG_NEGO_EXTENDER          0x00100000
 #define SECPKG_FLAG_NEGOTIABLE2            0x00200000
-#define SECPKG_FLAG_APPCONTAINER_PASSTHROUGH 0x00400000
-#define SECPKG_FLAG_APPCONTAINER_CHECKS    0x00800000
+#define SECPKG_FLAG_APPCONTAINER_PASSTHROUGH     0x00400000
+#define SECPKG_FLAG_APPCONTAINER_CHECKS          0x00800000
+#define SECPKG_FLAG_CREDENTIAL_ISOLATION_ENABLED 0x01000000
 
 #define SECPKG_ID_NONE  0xffff