diff --git a/src/mainboard/google/gru/Kconfig b/src/mainboard/google/gru/Kconfig
index 1b657d9a78..d5733c8312 100644
--- a/src/mainboard/google/gru/Kconfig
+++ b/src/mainboard/google/gru/Kconfig
@@ -18,6 +18,13 @@ config BOARD_GOOGLE_GRU_COMMON  # Umbrella option to be selected by variant boar
 
 if BOARD_GOOGLE_GRU_COMMON
 
+# Most Grus have TPM2 but later Kevins don't... decide this in one place for
+# convenience. Explicitly override it when building for earlier Kevins.
+config GRU_HAS_TPM2
+	bool "Build for a board revision with a SPI TPM 2.0"
+	default n if BOARD_GOOGLE_KEVIN
+	default y
+
 config BOARD_SPECIFIC_OPTIONS
 	def_bool y
 	select BOARD_ID_AUTO
@@ -30,7 +37,7 @@ config BOARD_SPECIFIC_OPTIONS
 	select MAINBOARD_DO_NATIVE_VGA_INIT
 	select MAINBOARD_HAS_CHROMEOS
 	select MAINBOARD_HAS_NATIVE_VGA_INIT
-	select MAINBOARD_HAS_TPM2
+	select MAINBOARD_HAS_TPM2 if GRU_HAS_TPM2
 	select RAM_CODE_SUPPORT
 	select RTC
 	select SOC_ROCKCHIP_RK3399
@@ -40,7 +47,7 @@ config BOARD_SPECIFIC_OPTIONS
 
 config CHROMEOS
 	select EC_SOFTWARE_SYNC
-	select SPI_TPM
+	select SPI_TPM if GRU_HAS_TPM2
 	select VBOOT_VBNV_FLASH
 	select VIRTUAL_DEV_SWITCH
 
@@ -64,6 +71,14 @@ config BOOT_MEDIA_SPI_BUS
 	int
 	default 1
 
+config DRIVER_TPM_I2C_BUS
+	hex
+	default 0
+
+config DRIVER_TPM_I2C_ADDR
+	hex
+	default 0x20
+
 config CONSOLE_SERIAL_UART_ADDRESS
 	hex
 	depends on DRIVERS_UART
diff --git a/src/mainboard/google/gru/bootblock.c b/src/mainboard/google/gru/bootblock.c
index 20334953a1..8f88043f92 100644
--- a/src/mainboard/google/gru/bootblock.c
+++ b/src/mainboard/google/gru/bootblock.c
@@ -18,6 +18,7 @@
 #include <bootblock_common.h>
 #include <soc/grf.h>
 #include <gpio.h>
+#include <soc/i2c.h>
 #include <soc/spi.h>
 #include <console/console.h>
 
@@ -68,9 +69,16 @@ void bootblock_mainboard_init(void)
 	write32(&rk3399_grf->iomux_spi5, IOMUX_SPI5);
 	rockchip_spi_init(CONFIG_EC_GOOGLE_CHROMEEC_SPI_BUS, 3093750);
 
-	/* Set pinmux and configure TPM SPI, which is not very fast. */
-	write32(&rk3399_grf->iomux_spi0, IOMUX_SPI0);
-	rockchip_spi_init(CONFIG_DRIVER_TPM_SPI_BUS, 1500*KHz);
+	if (IS_ENABLED(CONFIG_GRU_HAS_TPM2)) {
+		/* Set pinmux and configure TPM SPI, which is not very fast. */
+		write32(&rk3399_grf->iomux_spi0, IOMUX_SPI0);
+		rockchip_spi_init(CONFIG_DRIVER_TPM_SPI_BUS, 1500*KHz);
+	} else {
+		/* Set pinmux and configure TPM I2C */
+		write32(&rk3399_pmugrf->iomux_i2c0_scl, IOMUX_I2C0_SCL);
+		write32(&rk3399_pmugrf->iomux_i2c0_sda, IOMUX_I2C0_SDA);
+		i2c_init(0, 400*KHz);
+	}
 
 	setup_chromeos_gpios();
 }
diff --git a/src/soc/rockchip/rk3399/Makefile.inc b/src/soc/rockchip/rk3399/Makefile.inc
index 7a5e7a1e7a..768367ec22 100644
--- a/src/soc/rockchip/rk3399/Makefile.inc
+++ b/src/soc/rockchip/rk3399/Makefile.inc
@@ -17,6 +17,7 @@ ifeq ($(CONFIG_SOC_ROCKCHIP_RK3399),y)
 
 IDBTOOL = util/rockchip/make_idb.py
 
+bootblock-y += ../common/i2c.c
 bootblock-y += ../common/spi.c
 ifeq ($(CONFIG_BOOTBLOCK_CONSOLE),y)
 bootblock-$(CONFIG_DRIVERS_UART) += ../common/uart.c
@@ -32,6 +33,7 @@ verstage-y += ../common/cbmem.c
 verstage-y += ../common/gpio.c
 verstage-y += gpio.c
 verstage-y += sdram.c
+verstage-y += ../common/i2c.c
 verstage-y += ../common/spi.c
 verstage-$(CONFIG_DRIVERS_UART) += ../common/uart.c
 verstage-y += clock.c