diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 780b6be637..9b7553dde5 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -1161,6 +1161,11 @@ static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)
             fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,
                               info->kernel_cmdline);
         }
+
+        if (info->shim_filename) {
+            load_image_to_fw_cfg_file(fw_cfg, "etc/boot/shim",
+                                      info->shim_filename);
+        }
     }
 
     /*
@@ -1195,6 +1200,7 @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
      * doesn't support secure.
      */
     assert(!(info->secure_board_setup && kvm_enabled()));
+    info->shim_filename = ms->shim_filename;
     info->kernel_filename = ms->kernel_filename;
     info->kernel_cmdline = ms->kernel_cmdline;
     info->initrd_filename = ms->initrd_filename;
diff --git a/include/hw/arm/boot.h b/include/hw/arm/boot.h
index a2e22bda8a..94386fdbea 100644
--- a/include/hw/arm/boot.h
+++ b/include/hw/arm/boot.h
@@ -39,6 +39,7 @@ void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename,
 /* arm_boot.c */
 struct arm_boot_info {
     uint64_t ram_size;
+    const char *shim_filename;
     const char *kernel_filename;
     const char *kernel_cmdline;
     const char *initrd_filename;