diff --git a/src/arch/arm64/include/bits/lkrn.h b/src/arch/arm64/include/bits/lkrn.h
index 943464e9b..bcc6d1eed 100644
--- a/src/arch/arm64/include/bits/lkrn.h
+++ b/src/arch/arm64/include/bits/lkrn.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( FORBIDDEN );
 
 /** Header magic value */
 #define LKRN_MAGIC_ARCH LKRN_MAGIC_AARCH64
diff --git a/src/arch/riscv/include/bits/lkrn.h b/src/arch/riscv/include/bits/lkrn.h
index d26108647..18d3bf956 100644
--- a/src/arch/riscv/include/bits/lkrn.h
+++ b/src/arch/riscv/include/bits/lkrn.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <ipxe/hart.h>
 
diff --git a/src/image/lkrn.c b/src/image/lkrn.c
index a2044cb82..206bb57e5 100644
--- a/src/image/lkrn.c
+++ b/src/image/lkrn.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <stdint.h>
 #include <string.h>
diff --git a/src/include/bits/lkrn.h b/src/include/bits/lkrn.h
index 58aee73a2..609ee2c82 100644
--- a/src/include/bits/lkrn.h
+++ b/src/include/bits/lkrn.h
@@ -11,6 +11,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define LKRN_MAGIC_ARCH 0
 
diff --git a/src/include/ipxe/lkrn.h b/src/include/ipxe/lkrn.h
index 88b4d0485..3749a37d7 100644
--- a/src/include/ipxe/lkrn.h
+++ b/src/include/ipxe/lkrn.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <stdint.h>