The confidentiality of cryptographic secrets is crucial for the security of modern computing systems. However, ensuring confidentiality is difficult in the presence of privileged attackers or transient-execution vulnerabilities such as Meltdown or Spectre. While Trusted Execution Environments (TEEs) provide robust protection, they suffer from limited hardware availability, performance overhead, and the need for substantial system redesign, making them impractical for many deployments. In this paper, we present Lixom, a lightweight and generic technique to prevent data leakage of cryptographic secrets on x86 processors. Lixom achieves its confidentiality guarantees by storing secrets in code instead of data and preventing access to them with execute-only memory (XOM). In virtual machines, Lixom protects secrets from a compromised guest kernel, providing security guarantees akin to TEEs. Additionally, Lixom protects against Spectre, Meltdown, and Foreshadow attacks without performance overhead for algorithms such as AES. In 3 case studies, we show that Lixom improves the security of applications like disk encryption or digital rights management in real-world applications.