diff --git a/src/soc/intel/alderlake/cpu.c b/src/soc/intel/alderlake/cpu.c
index c2efff3419..615bd43c31 100644
--- a/src/soc/intel/alderlake/cpu.c
+++ b/src/soc/intel/alderlake/cpu.c
@@ -20,6 +20,7 @@
 #include <intelblocks/mp_init.h>
 #include <intelblocks/msr.h>
 #include <intelblocks/acpi.h>
+#include <option.h>
 #include <soc/cpu.h>
 #include <soc/msr.h>
 #include <soc/pci_devs.h>
@@ -140,7 +141,7 @@ void soc_core_init(struct device *cpu)
 	/* Enable Turbo */
 	enable_turbo();
 
-	if (CONFIG(INTEL_TME) && is_tme_supported())
+	if (get_uint_option("intel_tme", CONFIG(INTEL_TME)) && is_tme_supported())
 		set_tme_core_activate();
 }
 
diff --git a/src/soc/intel/alderlake/romstage/fsp_params.c b/src/soc/intel/alderlake/romstage/fsp_params.c
index 4bb2980b2b..d6224658ae 100644
--- a/src/soc/intel/alderlake/romstage/fsp_params.c
+++ b/src/soc/intel/alderlake/romstage/fsp_params.c
@@ -226,7 +226,7 @@ static void fill_fspm_security_params(FSP_M_CONFIG *m_cfg,
 {
 	/* Disable BIOS Guard */
 	m_cfg->BiosGuard = 0;
-	m_cfg->TmeEnable = CONFIG(INTEL_TME) && is_tme_supported();
+	m_cfg->TmeEnable = get_uint_option("intel_tme", CONFIG(INTEL_TME)) && is_tme_supported();
 }
 
 static void fill_fspm_uart_params(FSP_M_CONFIG *m_cfg,
diff --git a/src/soc/intel/common/block/include/intelblocks/cfr.h b/src/soc/intel/common/block/include/intelblocks/cfr.h
index 7828e1f359..15dcacab23 100644
--- a/src/soc/intel/common/block/include/intelblocks/cfr.h
+++ b/src/soc/intel/common/block/include/intelblocks/cfr.h
@@ -8,6 +8,7 @@
 #define SOC_INTEL_CMN_CFR_H
 
 #include <drivers/option/cfr_frontend.h>
+#include <cpu/intel/common/common.h>
 #include <intelblocks/pcie_rp.h>
 #include <intelblocks/pmclib.h>
 
@@ -133,4 +134,21 @@ static const struct sm_object pciexp_speed = SM_DECLARE_ENUM({
 				SM_ENUM_VALUE_END		},
 });
 
+/* TME */
+static void update_intel_tme(struct sm_object *new)
+{
+	if (!is_tme_supported())
+		new->sm_bool.flags |= CFR_OPTFLAG_SUPPRESS;
+}
+
+static const struct sm_object intel_tme = SM_DECLARE_BOOL({
+	.opt_name	= "intel_tme",
+	.ui_name	= "Total Memory Encryption",
+	.ui_helptext	= "Enable TME (Total Memory Encryption). When enabled, all data stored in"
+			  " system memory is encrypted to prevent unauthorized access or data theft."
+			  " Disabling TME decreases boot time by around 100ms",
+	.default_value	= CONFIG(INTEL_TME),
+}, WITH_CALLBACK(update_intel_tme));
+
+
 #endif /* SOC_INTEL_CMN_CFR_H */
diff --git a/src/soc/intel/meteorlake/cpu.c b/src/soc/intel/meteorlake/cpu.c
index b4854cb6ef..05fe9a9756 100644
--- a/src/soc/intel/meteorlake/cpu.c
+++ b/src/soc/intel/meteorlake/cpu.c
@@ -15,6 +15,7 @@
 #include <intelblocks/cpulib.h>
 #include <intelblocks/mp_init.h>
 #include <intelblocks/msr.h>
+#include <option.h>
 #include <soc/cpu.h>
 #include <soc/msr.h>
 #include <soc/pci_devs.h>
@@ -142,7 +143,7 @@ void soc_core_init(struct device *cpu)
 	/* Set core type in struct cpu_info */
 	set_dev_core_type();
 
-	if (CONFIG(INTEL_TME) && is_tme_supported())
+	if (get_uint_option("intel_tme", CONFIG(INTEL_TME)) && is_tme_supported())
 		set_tme_core_activate();
 
 	if (CONFIG(DROP_CPU_FEATURE_PROGRAM_IN_FSP)) {
diff --git a/src/soc/intel/meteorlake/romstage/fsp_params.c b/src/soc/intel/meteorlake/romstage/fsp_params.c
index cec8304281..d6c0b04782 100644
--- a/src/soc/intel/meteorlake/romstage/fsp_params.c
+++ b/src/soc/intel/meteorlake/romstage/fsp_params.c
@@ -198,7 +198,7 @@ static void fill_fspm_cpu_params(FSP_M_CONFIG *m_cfg,
 
 static void fill_tme_params(FSP_M_CONFIG *m_cfg)
 {
-	m_cfg->TmeEnable = CONFIG(INTEL_TME) && is_tme_supported();
+	m_cfg->TmeEnable = get_uint_option("intel_tme", CONFIG(INTEL_TME)) && is_tme_supported();
 	if (!m_cfg->TmeEnable || acpi_is_wakeup_s3())
 		return;
 	m_cfg->GenerateNewTmeKey = CONFIG(TME_KEY_REGENERATION_ON_WARM_BOOT) &&
diff --git a/src/soc/intel/pantherlake/cpu.c b/src/soc/intel/pantherlake/cpu.c
index f821507749..40b216d697 100644
--- a/src/soc/intel/pantherlake/cpu.c
+++ b/src/soc/intel/pantherlake/cpu.c
@@ -16,6 +16,7 @@
 #include <intelblocks/mp_init.h>
 #include <intelblocks/msr.h>
 #include <intelblocks/pmclib.h>
+#include <option.h>
 #include <smbios.h>
 #include <soc/cpu.h>
 #include <soc/msr.h>
@@ -141,7 +142,7 @@ void soc_core_init(struct device *cpu)
 	/* Set core type in struct cpu_info */
 	set_dev_core_type();
 
-	if (CONFIG(INTEL_TME) && is_tme_supported())
+	if (get_uint_option("intel_tme", CONFIG(INTEL_TME)) && is_tme_supported())
 		set_tme_core_activate();
 
 	if (CONFIG(DROP_CPU_FEATURE_PROGRAM_IN_FSP)) {
diff --git a/src/soc/intel/pantherlake/romstage/fsp_params.c b/src/soc/intel/pantherlake/romstage/fsp_params.c
index 46458af5ce..5ec92bb80f 100644
--- a/src/soc/intel/pantherlake/romstage/fsp_params.c
+++ b/src/soc/intel/pantherlake/romstage/fsp_params.c
@@ -10,6 +10,7 @@
 #include <fsp/util.h>
 #include <intelbasecode/ramtop.h>
 #include <intelblocks/cpulib.h>
+#include <option.h>
 #include <soc/iomap.h>
 #include <soc/msr.h>
 #include <soc/pcie.h>
@@ -112,7 +113,7 @@ static void fill_fspm_cpu_params(FSP_M_CONFIG *m_cfg,
 
 static void fill_tme_params(FSP_M_CONFIG *m_cfg)
 {
-	m_cfg->TmeEnable = CONFIG(INTEL_TME) && is_tme_supported();
+	m_cfg->TmeEnable = get_uint_option("intel_tme", CONFIG(INTEL_TME)) && is_tme_supported();
 	if (!m_cfg->TmeEnable || acpi_is_wakeup_s3())
 		return;
 	m_cfg->GenerateNewTmeKey = CONFIG(TME_KEY_REGENERATION_ON_WARM_BOOT);
diff --git a/src/soc/intel/tigerlake/romstage/fsp_params.c b/src/soc/intel/tigerlake/romstage/fsp_params.c
index 0f6c80cfec..6f8c5eb9e6 100644
--- a/src/soc/intel/tigerlake/romstage/fsp_params.c
+++ b/src/soc/intel/tigerlake/romstage/fsp_params.c
@@ -220,7 +220,7 @@ static void soc_memory_init_params(FSP_M_CONFIG *m_cfg,
 			m_cfg->CpuPcieRpEnableMask |= 1 << i;
 	}
 
-	m_cfg->TmeEnable = CONFIG(INTEL_TME) && is_tme_supported();
+	m_cfg->TmeEnable = get_uint_option("intel_tme", CONFIG(INTEL_TME)) && is_tme_supported();
 
 	/* crashLog config */
 	m_cfg->CpuCrashLogDevice = CONFIG(SOC_INTEL_CRASHLOG) && is_devfn_enabled(SA_DEVFN_TMT);