diff --git a/board/cr50/board.c b/board/cr50/board.c
index 7a49649ac1..9a1be332b4 100644
--- a/board/cr50/board.c
+++ b/board/cr50/board.c
@@ -71,7 +71,13 @@ uint32_t nvmem_user_sizes[NVMEM_NUM_USERS] = {
 
 /*  Board specific configuration settings */
 static uint32_t board_properties;
+static uint8_t reboot_request_posted;
 
+void post_reboot_request(void)
+{
+	/* Reboot the device next time TPM reset is requested. */
+	reboot_request_posted = 1;
+}
 /*
  * There's no way to trigger on both rising and falling edges, so force a
  * compiler error if we try. The workaround is to use the pinmux to connect
@@ -378,6 +384,9 @@ void sys_rst_asserted(enum gpio_signal signal)
 		return;
 	}
 
+	if (reboot_request_posted)
+		system_reset(SYSTEM_RESET_HARD);  /* This will never return. */
+
 	/* Re-initialize the TPM software state */
 	tpm_reset();
 }
diff --git a/board/cr50/board.h b/board/cr50/board.h
index 9eb67991a2..fd59137090 100644
--- a/board/cr50/board.h
+++ b/board/cr50/board.h
@@ -139,6 +139,7 @@ void board_configure_deep_sleep_wakepins(void);
 /* Interrupt handler */
 void sys_rst_asserted(enum gpio_signal signal);
 void device_state_on(enum gpio_signal signal);
+void post_reboot_request(void);
 
 /* Special controls over EC and AP */
 void assert_sys_rst(void);
diff --git a/chip/g/usb_upgrade.c b/chip/g/usb_upgrade.c
index 7f58f57fc8..493cd7cc92 100644
--- a/chip/g/usb_upgrade.c
+++ b/chip/g/usb_upgrade.c
@@ -182,14 +182,12 @@ static void upgrade_out_handler(struct consumer const *consumer, size_t count)
 
 	if (rx_state_ == rx_awaiting_reset) {
 		/*
-		 * Any USB data received in this state triggers reset, no
+		 * Any USB data received in this state should cause a post of
+		 * a system reset request on the next TPM reboot, no USB
 		 * response required.
 		 */
-		CPRINTS("reboot hard");
-		cflush();
-		system_reset(SYSTEM_RESET_HARD);
-		while (1)
-			;
+		rx_state_ = rx_idle;
+		post_reboot_request();
 	}
 
 	if (rx_state_ == rx_outside_block) {