diff --git a/src/drivers/intel/dtbt/dtbt.c b/src/drivers/intel/dtbt/dtbt.c
index 695f44105e..59d7847bd2 100644
--- a/src/drivers/intel/dtbt/dtbt.c
+++ b/src/drivers/intel/dtbt/dtbt.c
@@ -11,6 +11,7 @@
 #include "chip.h"
 #include "dtbt.h"
 
+static struct device_operations dtbt_device_ops;
 
 /* Returns true on success, false on timeout or TBT2PCIE Error field non-zero */
 static bool dtbt_cmd(struct device *dev, u8 command, u32 data, u32 timeout)
@@ -183,6 +184,16 @@ static void dtbt_enable(struct device *dev)
 	if (!is_dev_enabled(dev) || dev->path.pci.devfn != 0)
 		return;
 
+	/*
+	 * Only the upstream bridge has the firmware mailbox (PCIE2TBT/TBT2PCIE
+	 * registers). Downstream bridges behind it share the same PCI device ID
+	 * but have no mailbox, so sending commands to them will timeout. Skip any
+	 * bridge whose parent is also a dTBT bridge (i.e. a downstream bridge).
+	 */
+	if (dev->upstream && dev->upstream->dev &&
+	    dev->upstream->dev->ops == &dtbt_device_ops)
+		return;
+
 	printk(BIOS_INFO, "dTBT controller found at %s\n", dev_path(dev));
 
 	/* Set security level (Table 37/428); failure aborts enable */