diff --git a/src/boot.sh b/src/boot.sh
index b90cd587..df86df6f 100644
--- a/src/boot.sh
+++ b/src/boot.sh
@@ -52,6 +52,7 @@ case "${BOOT_MODE,,}" in
     VARS="OVMF_VARS_4M.ms.fd"
     ;;
   "windows_legacy" )
+    SECURE="on"
     BOOT_DESC=" (legacy)"
     USB="usb-ehci,id=ehci"
     ;;