diff --git a/firmware/lib/vboot_api_kernel.c b/firmware/lib/vboot_api_kernel.c
index 750edb248e..8f7be6ab33 100644
--- a/firmware/lib/vboot_api_kernel.c
+++ b/firmware/lib/vboot_api_kernel.c
@@ -201,6 +201,15 @@ VbError_t VbBootDeveloper(VbCommonParams* cparams, LoadKernelParams* p) {
         if (shared->flags & VBSD_HONOR_VIRT_DEV_SWITCH &&
             shared->flags & VBSD_BOOT_DEV_SWITCH_ON) {
           VbAudioClose(audio);    /* Stop the countdown while we go ask... */
+          if (gbb->flags & GBB_FLAG_FORCE_DEV_SWITCH_ON) {
+            /* TONORM won't work (only for non-shipping devices). */
+            VBDEBUG(("%s() - TONORM rejected by GBB_FLAG_FORCE_DEV_SWITCH_ON\n",
+                     __func__));
+            VbExDisplayDebugInfo("WARNING: TONORM is prohibited by "
+                                 "GBB_FLAG_FORCE_DEV_SWITCH_ON.\n\n");
+            VbExBeep(120, 400);
+            break;
+          }
           VbDisplayScreen(cparams, VB_SCREEN_DEVELOPER_TO_NORM, 0, &vnc);
           switch (VbUserConfirms(cparams, 0)) { /* Ignore space */
           case 1: