diff --git a/src/arch/arm64/Kconfig b/src/arch/arm64/Kconfig
index af5050b21b..9853ceddc0 100644
--- a/src/arch/arm64/Kconfig
+++ b/src/arch/arm64/Kconfig
@@ -68,6 +68,14 @@ config ARM64_USE_SECURE_OS
 	default n
 	depends on ARM64_USE_ARM_TRUSTED_FIRMWARE
 
+config ARM64_USE_SECURE_OS_PAYLOAD
+	bool
+	default n
+	depends on ARM64_USE_SECURE_OS
+	help
+	  This option adds support for packing the SECURE_OS image as a CBFS
+	  payload type when it spans non-contiguous memory regions.
+
 config ARM64_SECURE_OS_FILE
 	string "Secure OS binary file"
 	depends on ARM64_USE_SECURE_OS
diff --git a/src/arch/arm64/Makefile.mk b/src/arch/arm64/Makefile.mk
index f54c6d22fc..279d31fb47 100644
--- a/src/arch/arm64/Makefile.mk
+++ b/src/arch/arm64/Makefile.mk
@@ -219,7 +219,11 @@ ifeq ($(CONFIG_ARM64_USE_SECURE_OS),y)
 SECURE_OS_FILE := $(CONFIG_ARM64_SECURE_OS_FILE)
 SECURE_OS_FILE_CBFS := $(CONFIG_CBFS_PREFIX)/secure_os
 $(SECURE_OS_FILE_CBFS)-file := $(SECURE_OS_FILE)
+ifeq ($(CONFIG_ARM64_USE_SECURE_OS_PAYLOAD),y)
+$(SECURE_OS_FILE_CBFS)-type := payload
+else
 $(SECURE_OS_FILE_CBFS)-type := stage
+endif # CONFIG_ARM64_USE_SECURE_OS_PAYLOAD
 cbfs-files-y += $(SECURE_OS_FILE_CBFS)
 
 check-ramstage-overlap-files += $(SECURE_OS_FILE_CBFS)
diff --git a/src/arch/arm64/bl31.c b/src/arch/arm64/bl31.c
index 06676bcab8..a0402d7351 100644
--- a/src/arch/arm64/bl31.c
+++ b/src/arch/arm64/bl31.c
@@ -84,8 +84,13 @@ void run_bl31(u64 payload_entry, u64 payload_arg0, u64 payload_spsr)
 		struct prog bl32 = PROG_INIT(PROG_BL32,
 					     CONFIG_CBFS_PREFIX"/secure_os");
 
-		if (cbfs_prog_stage_load(&bl32))
-			die("BL32 load failed");
+		if (CONFIG(ARM64_USE_SECURE_OS_PAYLOAD)) {
+			if (!selfload(&bl32))
+				die("BL32 load failed");
+		} else {
+			if (cbfs_prog_stage_load(&bl32))
+				die("BL32 load failed");
+		}
 
 		bl32_ep_info.pc = (uintptr_t)prog_entry(&bl32);
 		bl32_ep_info.spsr = SPSR_EXCEPTION_MASK |