diff --git a/mantle/kola/harness.go b/mantle/kola/harness.go
index e3e0876154..2b74f9f729 100644
--- a/mantle/kola/harness.go
+++ b/mantle/kola/harness.go
@@ -100,6 +100,9 @@ const snoozeFormat = "2006-01-02"
 // This overlaps with SkipBaseChecksTag above, but is really a special flag for kola-denylist.yaml.
 const SkipConsoleWarningsTag = "skip-console-warnings"
 
+// NeedsSecureBoot will setup the machines with uefi with secure boot enabled on supported platforms
+const secureBoot = "secure-boot"
+
 var (
 	plog = capnslog.NewPackageLogger("github.com/coreos/coreos-assembler/mantle", "kola")
 
@@ -338,6 +341,10 @@ func testRequiresInternet(test *register.Test) bool {
 	return HasString(NeedsInternetTag, test.Tags)
 }
 
+func testSecureBoot(test *register.Test) bool {
+	return HasString(secureBoot, test.Tags)
+}
+
 func markTestForRerunSuccess(test *register.Test, msg string) {
 	if !HasString(AllowRerunSuccessTag, test.Tags) {
 		plog.Warningf("%s Adding as candidate for rerun success: %s", msg, test.Name)
@@ -1762,6 +1769,10 @@ func runTest(h *harness.H, t *register.Test, pltfrm string, flight platform.Flig
 			InstanceType:              t.InstanceType,
 		}
 
+		if testSecureBoot(t) {
+			options.Firmware = "uefi-secure"
+		}
+
 		// Providers sometimes fail to bring up a machine within a
 		// reasonable time frame. Let's try twice and then bail if
 		// it doesn't work.
diff --git a/mantle/platform/machine/qemu/cluster.go b/mantle/platform/machine/qemu/cluster.go
index 817c733e24..a6b51e9219 100644
--- a/mantle/platform/machine/qemu/cluster.go
+++ b/mantle/platform/machine/qemu/cluster.go
@@ -54,6 +54,7 @@ func (qc *Cluster) NewMachineWithOptions(userdata *conf.UserData, options platfo
 	}
 	return qc.NewMachineWithQemuOptions(userdata, platform.QemuMachineOptions{
 		MachineOptions: options,
+		Firmware:       options.Firmware,
 	})
 }
 
diff --git a/mantle/platform/platform.go b/mantle/platform/platform.go
index 22461fbb92..961fbb178d 100644
--- a/mantle/platform/platform.go
+++ b/mantle/platform/platform.go
@@ -164,6 +164,7 @@ type MachineOptions struct {
 	AppendFirstbootKernelArgs string
 	SkipStartMachine          bool // Skip platform.StartMachine on machine bringup
 	InstanceType              string
+	Firmware                  string
 }
 
 // SystemdDropin is a userdata type agnostic struct representing a systemd dropin