diff --git a/README.md b/README.md
index ce0b303..05ec960 100644
--- a/README.md
+++ b/README.md
@@ -103,6 +103,16 @@ cd firmware
 SPIPI=<user@spipi> ./scripts/spipi-flash.sh <model>
 ```
 
+## Intel Management Engine
+
+The IME is present, but disabled. This is accomplished by [sending a HECI
+command on boot][heci_disable], before RAM is initalized. This puts the IME in
+a state similar to setting the HAP bit on earlier platforms. [me_cleaner] is
+not used as it does not support IME version 14.0.
+
+[heci_disable]: https://github.com/system76/coreboot/blob/f3ba5937e778105cb7e75de9a1d4adf54ea825e5/src/soc/intel/cannonlake/me.c#L186
+[me_cleaner]:https://github.com/corna/me_cleaner
+
 ## Contents
 
 - [apps](./apps) - Applications
diff --git a/README.md.in b/README.md.in
index 81d5c7f..f4bc196 100644
--- a/README.md.in
+++ b/README.md.in
@@ -102,3 +102,13 @@ cd firmware
 ```
 SPIPI=<user@spipi> ./scripts/spipi-flash.sh <model>
 ```
+
+## Intel Management Engine
+
+The IME is present, but disabled. This is accomplished by [sending a HECI
+command on boot][heci_disable], before RAM is initalized. This puts the IME in
+a state similar to setting the HAP bit on earlier platforms. [me_cleaner] is
+not used as it does not support IME version 14.0.
+
+[heci_disable]: https://github.com/system76/coreboot/blob/f3ba5937e778105cb7e75de9a1d4adf54ea825e5/src/soc/intel/cannonlake/me.c#L186
+[me_cleaner]:https://github.com/corna/me_cleaner