diff --git a/meta-aspeed/conf/machine/evb-ast2600.conf b/meta-aspeed/conf/machine/evb-ast2600.conf
index 5fbc71e..9b54658 100644
--- a/meta-aspeed/conf/machine/evb-ast2600.conf
+++ b/meta-aspeed/conf/machine/evb-ast2600.conf
@@ -3,6 +3,15 @@
 UBOOT_MACHINE = "ast2600_openbmc_spl_defconfig"
 UBOOT_DEVICETREE = "ast2600-evb"
 SPL_BINARY = "spl/u-boot-spl.bin"
+# Disable hardware root of trust by default.
+# If users want to enable secure boot,
+# please do the following steps.
+# 1. Set SOCSEC_SIGN_ENABLE to “1”.
+# 2. Provide platform OTP config.
+# There was an example in p10bmc.
+# If users enable socsec signing but do not provide OTP config,
+# u-boot will be built failed.
+SOCSEC_SIGN_ENABLE = "0"
 
 require conf/machine/include/ast2600.inc
 require conf/machine/include/obmc-evb-common.inc