diff --git a/board/cr50/rdd.c b/board/cr50/rdd.c
index 106c559103..e645d610c1 100644
--- a/board/cr50/rdd.c
+++ b/board/cr50/rdd.c
@@ -301,6 +301,9 @@ static int command_sys_rst(int argc, char **argv)
 	int ms = 20;
 
 	if (argc > 1) {
+		if (!ccd_is_cap_enabled(CCD_CAP_REBOOT_EC_AP))
+			return EC_ERROR_ACCESS_DENIED;
+
 		if (!strcasecmp("pulse", argv[1])) {
 			if (argc == 3) {
 				ms = strtoi(argv[2], &e, 0);
@@ -335,6 +338,9 @@ static int command_ec_rst(int argc, char **argv)
 	int val;
 
 	if (argc > 1) {
+		if (!ccd_is_cap_enabled(CCD_CAP_REBOOT_EC_AP))
+			return EC_ERROR_ACCESS_DENIED;
+
 		if (!strcasecmp("pulse", argv[1])) {
 			ccprintf("Pulsing EC reset\n");
 			assert_ec_rst();