diff --git a/src/soc/intel/cannonlake/Kconfig b/src/soc/intel/cannonlake/Kconfig
index 259a4a04d3..0a92f5d68f 100644
--- a/src/soc/intel/cannonlake/Kconfig
+++ b/src/soc/intel/cannonlake/Kconfig
@@ -358,4 +358,8 @@ config INTEL_GMA_BCLM_OFFSET
 config INTEL_GMA_BCLM_WIDTH
 	default 32
 
+config DISABLE_ME
+	bool "Disable the IME by setting the HAP bit at run-time"
+	default y
+
 endif
diff --git a/src/soc/intel/cannonlake/me.c b/src/soc/intel/cannonlake/me.c
index 96213d110f..1be3616cf8 100644
--- a/src/soc/intel/cannonlake/me.c
+++ b/src/soc/intel/cannonlake/me.c
@@ -154,8 +154,7 @@ void dump_me_status(void *unused)
 		hfsts6.fields.txt_support ? "YES" : "NO");
 }
 
-#define DISABLE_ME 1
-#if DISABLE_ME
+#if CONFIG(DISABLE_ME)
 
 static void disable_me(void* unused)
 {