diff --git a/CHANGES.rst b/CHANGES.rst
index 440024230..22ce6c1cd 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -20,12 +20,17 @@ development at the same time, such as 4.5.x and 5.0.
 Unreleased
 ----------
 
+- Fix: the PYTHONSAFEPATH environment variable new in Python 3.11 is properly
+  supported, closing `issue 1696`_.  Thanks, `Philipp A. <pull 1700_>`_.
+
 - Added new :ref:`debug options <cmd_run_debug>`:
 
   - ``pytest`` writes the pytest test name into the debug output.
 
   - ``dataop2`` writes the full data being added to CoverageData objects.
 
+.. _issue 1696: https://github.com/nedbat/coveragepy/issues/1696
+.. _pull 1700: https://github.com/nedbat/coveragepy/pull/1700
 
 .. scriv-start-here
 
diff --git a/coverage/execfile.py b/coverage/execfile.py
index 953db2ead..7a2a1b102 100644
--- a/coverage/execfile.py
+++ b/coverage/execfile.py
@@ -90,7 +90,7 @@ def prepare(self) -> None:
         This needs to happen before any importing, and without importing anything.
         """
         path0: Optional[str]
-        if env.PYVERSION >= (3, 11) and os.environ.get('PYTHONSAFEPATH', ''):
+        if env.PYVERSION >= (3, 11) and os.getenv("PYTHONSAFEPATH"):
             # See https://docs.python.org/3/using/cmdline.html#cmdoption-P
             path0 = None
         elif self.as_module:
diff --git a/tests/test_execfile.py b/tests/test_execfile.py
index 0d575fcce..c532f9124 100644
--- a/tests/test_execfile.py
+++ b/tests/test_execfile.py
@@ -307,15 +307,6 @@ def test_pkg1_init(self) -> None:
         assert out == "pkg1.__init__: pkg1\npkg1.__init__: __main__\n"
         assert err == ""
 
-    def test_pythonpath(self, tmp_path: Path) -> None:
-        self.set_environ("PYTHONSAFEPATH", "1")
-        with change_dir(tmp_path):
-            run_python_module(["process_test.try_execfile"])
-        out, err = self.stdouterr()
-        mod_globs = json.loads(out)
-        assert tmp_path not in mod_globs["path"]
-        assert err == ""
-
     def test_no_such_module(self) -> None:
         with pytest.raises(NoSource, match="No module named '?i_dont_exist'?"):
             run_python_module(["i_dont_exist"])
diff --git a/tests/test_process.py b/tests/test_process.py
index 8fc45d930..3f67ad4bf 100644
--- a/tests/test_process.py
+++ b/tests/test_process.py
@@ -786,6 +786,25 @@ def test_coverage_zip_is_like_python(self) -> None:
         actual = self.run_command(f"python {cov_main} run run_me.py")
         self.assert_tryexecfile_output(expected, actual)
 
+    def test_pythonsafepath(self) -> None:
+        with open(TRY_EXECFILE) as f:
+            self.make_file("run_me.py", f.read())
+        self.set_environ("PYTHONSAFEPATH", "1")
+        expected = self.run_command("python run_me.py")
+        actual = self.run_command("coverage run run_me.py")
+        self.assert_tryexecfile_output(expected, actual)
+
+    @pytest.mark.skipif(env.PYVERSION < (3, 11), reason="PYTHONSAFEPATH is new in 3.11")
+    def test_pythonsafepath_dashm(self) -> None:
+        with open(TRY_EXECFILE) as f:
+            self.make_file("with_main/__main__.py", f.read())
+
+        self.set_environ("PYTHONSAFEPATH", "1")
+        expected = self.run_command("python -m with_main")
+        actual = self.run_command("coverage run -m with_main")
+        assert re.search(f"No module named '?with_main'?", actual)
+        assert re.search(f"No module named '?with_main'?", expected)
+
     def test_coverage_custom_script(self) -> None:
         # https://github.com/nedbat/coveragepy/issues/678
         # If sys.path[0] isn't the Python default, then coverage.py won't