diff --git a/src/soc/intel/tigerlake/Kconfig b/src/soc/intel/tigerlake/Kconfig
index 9d073fa5f9..843ffe63e1 100644
--- a/src/soc/intel/tigerlake/Kconfig
+++ b/src/soc/intel/tigerlake/Kconfig
@@ -250,4 +250,9 @@ config EARLY_TCSS_DISPLAY
 	help
 	  Enable displays to be detected over Type-C ports during boot.
 
+config DISABLE_ME
+	bool "Disable the IME by setting the HAP bit at run-time"
+	# XXX: Prevents CPU from reaching C10
+	default n
+
 endif
diff --git a/src/soc/intel/tigerlake/me.c b/src/soc/intel/tigerlake/me.c
index da1a2992e6..96313c4ad2 100644
--- a/src/soc/intel/tigerlake/me.c
+++ b/src/soc/intel/tigerlake/me.c
@@ -163,5 +163,33 @@ static void dump_me_status(void *unused)
 		hfsts6.fields.txt_support ? "YES" : "NO");
 }
 
+#if CONFIG(DISABLE_ME)
+
+static void disable_me(void* unused)
+{
+	printk(BIOS_DEBUG, "ME: send disable message\n");
+
+	struct disable_command {
+		uint32_t hdr;
+		uint32_t rule_id;
+		uint8_t rule_len;
+		uint32_t rule_data;
+	} __packed msg;
+	msg.hdr = 0x303;
+	msg.rule_id = 6;
+	msg.rule_len = 4;
+	msg.rule_data = 0;
+
+	if (!heci_send(&msg, sizeof(msg), BIOS_HOST_ADDR, HECI_MKHI_ADDR))
+		printk(BIOS_ERR, "ME: Error sending DISABLE msg\n");
+	dump_me_status(unused);
+}
+
+BOOT_STATE_INIT_ENTRY(BS_OS_RESUME_CHECK, BS_ON_EXIT, disable_me, NULL);
+
+#else // DISABLE_ME
+
 BOOT_STATE_INIT_ENTRY(BS_DEV_ENABLE, BS_ON_EXIT, print_me_fw_version, NULL);
 BOOT_STATE_INIT_ENTRY(BS_OS_RESUME_CHECK, BS_ON_EXIT, dump_me_status, NULL);
+
+#endif // DISABLE_ME