diff --git a/src/vendorcode/google/chromeos/vboot2/vboot_handoff.c b/src/vendorcode/google/chromeos/vboot2/vboot_handoff.c
index a8573d0c88..7a61429d2f 100644
--- a/src/vendorcode/google/chromeos/vboot2/vboot_handoff.c
+++ b/src/vendorcode/google/chromeos/vboot2/vboot_handoff.c
@@ -59,7 +59,7 @@ static void *load_ramstage(struct vboot_handoff *vboot_handoff,
 /**
  * Sets vboot_handoff based on the information in vb2_shared_data
  *
- * TODO: Read wp switch to set VBSD_BOOT_FIRMWARE_WP_ENABLED
+ * TODO: Add VBSD_BOOT_FIRMWARE_SW_WP_ENABLED logic
  */
 static void fill_vboot_handoff(struct vboot_handoff *vboot_handoff,
 			       struct vb2_shared_data *vb2_sd)
@@ -80,6 +80,9 @@ static void fill_vboot_handoff(struct vboot_handoff *vboot_handoff,
 	vb_sd->data_size = VB_SHARED_DATA_MIN_SIZE;
 	vb_sd->data_used = sizeof(VbSharedDataHeader);
 
+	if (get_write_protect_state())
+		vb_sd->flags |= VBSD_BOOT_FIRMWARE_WP_ENABLED;
+
 	if (vb2_sd->recovery_reason) {
 		vb_sd->firmware_index = 0xFF;
 		if (vb2_sd->recovery_reason == VB2_RECOVERY_RO_MANUAL)