diff --git a/src/device/Kconfig b/src/device/Kconfig
index d0d72f9a77..439118f10c 100644
--- a/src/device/Kconfig
+++ b/src/device/Kconfig
@@ -519,6 +519,19 @@ config PCIEXP_PLUGIN_SUPPORT
 	bool
 	default y
 
+config PCI_ALLOW_BUS_MASTER
+	bool "Allow PCI bus master bit to be enabled by coreboot"
+	default y
+	help
+	  For security reasons, bus mastering should be enabled as late as
+	  possible. In coreboot, it's usually not necessary and payloads
+	  should only enable it for devices they use. Since not all payloads
+	  enable bus mastering properly yet, this option gives some sort of
+	  "backwards compatibility" and is enabled by default to keep the
+	  traditional behaviour for now. This is currently necessary, for
+	  instance, for libpayload based payloads as the drivers don't enable
+	  bus mastering for PCI bridges.
+
 endif # PCI
 
 if PCIEXP_PLUGIN_SUPPORT
diff --git a/src/include/device/pci.h b/src/include/device/pci.h
index 4529074e9b..ec3d45e58b 100644
--- a/src/include/device/pci.h
+++ b/src/include/device/pci.h
@@ -128,6 +128,18 @@ static inline int pci_base_address_is_memory_space(unsigned int attr)
 }
 
 void pci_dev_disable_bus_master(const struct device *dev);
+
+static __always_inline
+#if ENV_PCI_SIMPLE_DEVICE
+void pci_dev_request_bus_master(pci_devfn_t dev)
+#else
+void pci_dev_request_bus_master(const struct device *dev)
+#endif /* ENV_PCI_SIMPLE_DEVICE */
+{
+	if (CONFIG(PCI_ALLOW_BUS_MASTER))
+		pci_or_config16(dev, PCI_COMMAND, PCI_COMMAND_MASTER);
+}
+
 #endif /* CONFIG_PCI */
 
 void pci_early_bridge_init(void);