diff --git a/firmware/2lib/2crypto.c b/firmware/2lib/2crypto.c
index 5906301..2b55386 100644
--- a/firmware/2lib/2crypto.c
+++ b/firmware/2lib/2crypto.c
@@ -11,8 +11,14 @@
 #include "2sha.h"
 #include "2sysincludes.h"
 
-/* These two need to be exported for host/lib/crypto.c */
+/*
+ * These two need to be exported for host/lib/crypto.c, but they also need to be
+ * in .rodata to make coreboot XIP stages happy. We know they are immutable but
+ * there is no C language way to guarantee that, so we have to manually force
+ * the compiler to place them in .rodata.
+ */
 
+__attribute__((section(".rodata.vb2_sig_names")))
 const char *vb2_sig_names[VB2_SIG_ALG_COUNT] = {
 	[VB2_SIG_NONE]		= "none",
 	[VB2_SIG_RSA1024]	= "RSA1024",
@@ -23,6 +29,7 @@
 	[VB2_SIG_RSA3072_EXP3]	= "RSA3072EXP3",
 };
 
+__attribute__((section(".rodata.vb2_hash_names")))
 const char *vb2_hash_names[VB2_HASH_ALG_COUNT] = {
 	[VB2_HASH_NONE]		= "none",
 #if VB2_SUPPORT_SHA1