diff --git a/src/soc/intel/common/block/include/intelblocks/systemagent.h b/src/soc/intel/common/block/include/intelblocks/systemagent.h
index fe14c181fb..f708fae674 100644
--- a/src/soc/intel/common/block/include/intelblocks/systemagent.h
+++ b/src/soc/intel/common/block/include/intelblocks/systemagent.h
@@ -79,6 +79,9 @@ uintptr_t sa_get_tseg_base(void);
 size_t sa_get_tseg_size(void);
 /* Fill MMIO resource above 4GB into GNVS */
 void sa_fill_gnvs(struct global_nvs *gnvs);
+/* API to lock PAM registers */
+void sa_lock_pam(void);
+
 /*
  * SoC overrides
  *
diff --git a/src/soc/intel/common/block/systemagent/systemagent.c b/src/soc/intel/common/block/systemagent/systemagent.c
index 6e02c811ec..45e1d4216f 100644
--- a/src/soc/intel/common/block/systemagent/systemagent.c
+++ b/src/soc/intel/common/block/systemagent/systemagent.c
@@ -306,6 +306,15 @@ void enable_power_aware_intr(void)
 	MCHBAR8(MCH_PAIR) = pair;
 }
 
+void sa_lock_pam(void)
+{
+	const struct device *dev = pcidev_path_on_root(SA_DEVFN_ROOT);
+	if (!dev)
+		return;
+
+	pci_or_config8(dev, PAM0, PAM_LOCK);
+}
+
 static struct device_operations systemagent_ops = {
 	.read_resources   = systemagent_read_resources,
 	.set_resources    = pci_dev_set_resources,
diff --git a/src/soc/intel/common/block/systemagent/systemagent_def.h b/src/soc/intel/common/block/systemagent/systemagent_def.h
index 7517b140fb..0add13e93e 100644
--- a/src/soc/intel/common/block/systemagent/systemagent_def.h
+++ b/src/soc/intel/common/block/systemagent/systemagent_def.h
@@ -35,6 +35,9 @@
 #define PAM5	0x85
 #define PAM6	0x86
 
+/* PAM0 contains the lock bit */
+#define PAM_LOCK	(1 << 0)
+
 /* Device 0:0.0 MMIO space */
 #define MCH_PAIR	0x5418