diff --git a/arch/sandbox/cpu/start.c b/arch/sandbox/cpu/start.c
index 777db4e..a74f5ec 100644
--- a/arch/sandbox/cpu/start.c
+++ b/arch/sandbox/cpu/start.c
@@ -400,6 +400,15 @@
 SANDBOX_CMDLINE_OPT_SHORT(signals, 'S', 0,
 			  "Handle signals (such as SIGSEGV) in sandbox");
 
+static int sandbox_cmdline_cb_autoboot_keyed(struct sandbox_state *state,
+					     const char *arg)
+{
+	state->autoboot_keyed = true;
+
+	return 0;
+}
+SANDBOX_CMDLINE_OPT(autoboot_keyed, 0, "Allow keyed autoboot");
+
 static void setup_ram_buf(struct sandbox_state *state)
 {
 	/* Zero the RAM buffer if we didn't read it, to keep valgrind happy */
diff --git a/arch/sandbox/cpu/state.c b/arch/sandbox/cpu/state.c
index a4d99ba..4e82253 100644
--- a/arch/sandbox/cpu/state.c
+++ b/arch/sandbox/cpu/state.c
@@ -4,6 +4,7 @@
  */
 
 #include <common.h>
+#include <autoboot.h>
 #include <bloblist.h>
 #include <errno.h>
 #include <fdtdec.h>
@@ -378,6 +379,23 @@
 	state->next_tag = state->ram_size;
 }
 
+bool autoboot_keyed(void)
+{
+	struct sandbox_state *state = state_get_current();
+
+	return IS_ENABLED(CONFIG_AUTOBOOT_KEYED) && state->autoboot_keyed;
+}
+
+bool autoboot_set_keyed(bool autoboot_keyed)
+{
+	struct sandbox_state *state = state_get_current();
+	bool old_val = state->autoboot_keyed;
+
+	state->autoboot_keyed = autoboot_keyed;
+
+	return old_val;
+}
+
 int state_init(void)
 {
 	state = &main_state;
diff --git a/arch/sandbox/include/asm/state.h b/arch/sandbox/include/asm/state.h
index 1c4c571..10352a5 100644
--- a/arch/sandbox/include/asm/state.h
+++ b/arch/sandbox/include/asm/state.h
@@ -94,6 +94,7 @@
 	bool run_unittests;		/* Run unit tests */
 	const char *select_unittests;	/* Unit test to run */
 	bool handle_signals;		/* Handle signals within sandbox */
+	bool autoboot_keyed;		/* Use keyed-autoboot feature */
 
 	/* Pointer to information for each SPI bus/cs */
 	struct sandbox_spi_info spi[CONFIG_SANDBOX_SPI_MAX_BUS]