diff --git a/board/bds/board.h b/board/bds/board.h
index 152b8ee182..16c5f972b6 100644
--- a/board/bds/board.h
+++ b/board/bds/board.h
@@ -132,6 +132,10 @@ enum temp_sensor_id {
 
 #define TMP006_COUNT 1
 
+/* Target value for BOOTCFG.  This currently toggles the polarity bit without
+ * enabling the boot loader, simply to prove we can program it. */
+#define BOOTCFG_VALUE 0xfffffdfe
+
 void configure_board(void);
 
 #endif /* __BOARD_H */
diff --git a/board/link/board.h b/board/link/board.h
index d57f598ec1..edd3687451 100644
--- a/board/link/board.h
+++ b/board/link/board.h
@@ -206,6 +206,16 @@ enum temp_sensor_id {
 /* The number of TMP006 sensor chips on the board. */
 #define TMP006_COUNT 4
 
+
+/* Target value for BOOTCFG.  This currently toggles the polarity bit without
+ * enabling the boot loader, simply to prove we can program it. */
+/* TODO: (crosbug.com/p/8769) set BOOTCFG to 0x7ffffffe, which will prevent
+ * subsequent writes to BOOTCFG.  Alternately, we could set BOOTCFG to some
+ * signal which has a pullup/pulldown, and use that as a failsafe to get into
+ * the boot loader, if we somehow brick the RO firmware. */
+#define BOOTCFG_VALUE 0xfffffdfe
+
+
 void configure_board(void);
 
 #endif /* __BOARD_H */
diff --git a/chip/lm4/registers.h b/chip/lm4/registers.h
index 10719965fd..357212cb36 100644
--- a/chip/lm4/registers.h
+++ b/chip/lm4/registers.h
@@ -211,6 +211,7 @@ static inline int lm4_fan_addr(int ch, int offset)
 #define LM4_SYSTEM_PIOSCCAL    LM4REG(0x400fe150)
 #define LM4_SYSTEM_PIOSCSTAT   LM4REG(0x400fe154)
 #define LM4_SYSTEM_PLLSTAT     LM4REG(0x400fe168)
+#define LM4_SYSTEM_BOOTCFG     LM4REG(0x400fe1d0)
 /* Note: USER_REG3 is used to hold pre-programming process data and should not
  * be modified by EC code.  See crosbug.com/p/8889. */
 #define LM4_SYSTEM_USER_REG3   LM4REG(0x400fe1ec)
diff --git a/chip/lm4/system.c b/chip/lm4/system.c
index f3bcf85a62..6923e3285b 100644
--- a/chip/lm4/system.c
+++ b/chip/lm4/system.c
@@ -5,6 +5,7 @@
 
 /* System module for Chrome EC : hardware specific implementation */
 
+#include "board.h"
 #include "cpu.h"
 #include "registers.h"
 #include "system.h"
@@ -121,7 +122,9 @@ int system_pre_init(void)
 				break;
 		}
 	}
-	/* initialize properly registers after reset (cf errata) */
+
+	/* Initialize registers after reset (cf errata) */
+	/* TODO: fixed in A3 chip stepping? */
 	wait_for_hibctl_wc();
 	LM4_HIBERNATE_HIBRTCT = 0x7fff;
 	wait_for_hibctl_wc();
@@ -129,6 +132,15 @@ int system_pre_init(void)
 
 	check_reset_cause();
 
+	/* Initialize bootcfg if needed */
+	if (LM4_SYSTEM_BOOTCFG != BOOTCFG_VALUE) {
+		LM4_FLASH_FMD = BOOTCFG_VALUE;
+		LM4_FLASH_FMA = 0x75100000;
+		LM4_FLASH_FMC = 0xa4420008;  /* WRKEY | COMT */
+		while (LM4_FLASH_FMC & 0x08)
+			;
+	}
+
 	return EC_SUCCESS;
 }