diff --git a/android/virtmgr/src/crosvm.rs b/android/virtmgr/src/crosvm.rs
index b28834a..94379a9 100644
--- a/android/virtmgr/src/crosvm.rs
+++ b/android/virtmgr/src/crosvm.rs
@@ -975,7 +975,11 @@
     if config.protected {
         match system_properties::read(SYSPROP_CUSTOM_PVMFW_PATH)? {
             Some(pvmfw_path) if !pvmfw_path.is_empty() => {
-                command.arg("--protected-vm-with-firmware").arg(pvmfw_path)
+                if pvmfw_path == "none" {
+                    command.arg("--protected-vm-without-firmware")
+                } else {
+                    command.arg("--protected-vm-with-firmware").arg(pvmfw_path)
+                }
             }
             _ => command.arg("--protected-vm"),
         };
diff --git a/guest/pvmfw/README.md b/guest/pvmfw/README.md
index 3ffa3f0..50fe3d3 100644
--- a/guest/pvmfw/README.md
+++ b/guest/pvmfw/README.md
@@ -487,3 +487,19 @@
 Note: `adb root` is required to set the system property.
 
 [bcc.dat]: https://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Virtualization/tests/pvmfw/assets/bcc.dat
+
+### Running pVM without pvmfw
+
+Sometimes, it might be useful to start a pVM without pvmfw, e.g. when debugging
+early pVM boot issues. You can achieve that by setting `hypervisor.pvmfw.path`
+propety to the value `none`:
+
+```shell
+adb shell 'setprop hypervisor.pvmfw.path "none"'
+```
+
+Then run a protected VM:
+
+```shell
+adb shell /apex/com.android.virt/bin/vm run-microdroid --protected
+```