diff --git a/build/microdroid/Android.bp b/build/microdroid/Android.bp
index 7f23ae6..0e98a92 100644
--- a/build/microdroid/Android.bp
+++ b/build/microdroid/Android.bp
@@ -485,7 +485,7 @@
     ],
 }
 
-flag_aware_avb_add_hash_footer_defaults {
+avb_add_hash_footer_defaults {
     name: "microdroid_kernel_signed_defaults",
     src: ":empty_file",
     partition_name: "boot",
@@ -500,10 +500,16 @@
             enabled: true,
         },
     },
+}
+
+MICRODROID_GKI_ROLLBACK_INDEX = 1
+
+flag_aware_avb_add_hash_footer_defaults {
+    name: "microdroid_kernel_cap_defaults",
     // Below are properties that are conditionally set depending on value of build flags.
     soong_config_variables: {
         release_avf_enable_llpvm_changes: {
-            rollback_index: 1,
+            rollback_index: MICRODROID_GKI_ROLLBACK_INDEX,
             props: [
                 {
                     name: "com.android.virt.cap",
@@ -514,9 +520,36 @@
     },
 }
 
+flag_aware_avb_add_hash_footer_defaults {
+    name: "microdroid_kernel_cap_with_uefi_defaults",
+    // Below are properties that are conditionally set depending on value of build flags.
+    soong_config_variables: {
+        release_avf_enable_llpvm_changes: {
+            rollback_index: MICRODROID_GKI_ROLLBACK_INDEX,
+            props: [
+                {
+                    name: "com.android.virt.cap",
+                    value: "secretkeeper_protection|supports_uefi_boot",
+                },
+            ],
+            conditions_default: {
+                props: [
+                    {
+                        name: "com.android.virt.cap",
+                        value: "supports_uefi_boot",
+                    },
+                ],
+            },
+        },
+    },
+}
+
 avb_add_hash_footer {
     name: "microdroid_kernel_signed",
-    defaults: ["microdroid_kernel_signed_defaults"],
+    defaults: [
+        "microdroid_kernel_signed_defaults",
+        "microdroid_kernel_cap_defaults",
+    ],
     filename: "microdroid_kernel",
     arch: {
         arm64: {
@@ -548,7 +581,10 @@
 
 avb_add_hash_footer {
     name: "microdroid_kernel_16k_signed",
-    defaults: ["microdroid_kernel_signed_defaults"],
+    defaults: [
+        "microdroid_kernel_signed_defaults",
+        "microdroid_kernel_cap_defaults",
+    ],
     filename: "microdroid_kernel_16k",
     arch: {
         arm64: {
@@ -588,10 +624,9 @@
     src: "microdroid_gki-android15-6.6.json",
 }
 
-avb_add_hash_footer {
-    name: "microdroid_gki-android15-6.6_kernel_signed",
+avb_add_hash_footer_defaults {
+    name: "microdroid_gki_kernel_signed_defaults",
     defaults: ["microdroid_kernel_signed_defaults"],
-    filename: "microdroid_gki-android15-6.6_kernel_signed",
     arch: {
         arm64: {
             src: ":microdroid_gki_kernel_prebuilts-android15-6.6-arm64",
@@ -606,6 +641,24 @@
     ],
 }
 
+avb_add_hash_footer {
+    name: "microdroid_gki-android15-6.6_kernel_signed",
+    defaults: [
+        "microdroid_gki_kernel_signed_defaults",
+        "microdroid_kernel_cap_defaults",
+    ],
+    filename: "microdroid_gki-android15-6.6_kernel_signed",
+}
+
+avb_add_hash_footer {
+    name: "microdroid_gki-android15-6.6_kernel_signed_supports_uefi_boot",
+    defaults: [
+        "microdroid_gki_kernel_signed_defaults",
+        "microdroid_kernel_cap_with_uefi_defaults",
+    ],
+    filename: "microdroid_gki-android15-6.6_kernel_signed_supports_uefi_boot",
+}
+
 // HACK: use cc_genrule for arch-specific properties
 cc_genrule {
     name: "microdroid_gki-android15-6.6_kernel_signed-lz4",