diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
index 0ff8354ebd..b16bdeb47f 100644
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
@@ -437,6 +437,12 @@ QemuLoadKernelImage (
         "OVMF: command line switch for qemu (available in version 10.0 + newer).\n"
         "\n"
         );
+      if (PcdGet64 (PcdConfidentialComputingGuestAttr)) {
+        AsciiPrint (
+          "OVMF: Running in confidential VM, not using insecure legacy linux kernel loader.\n"
+          );
+        return EFI_ACCESS_DENIED;
+      }
 
       RetStatus = QemuFwCfgParseBool (
                     "opt/org.tianocore/EnableLegacyLoader",
diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
index 09babd3be8..127674ab15 100644
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
@@ -44,3 +44,6 @@
 
 [Guids]
   gQemuKernelLoaderFsMediaGuid
+
+[Pcd]
+  gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr