diff --git a/firmware/2lib/2misc.c b/firmware/2lib/2misc.c
index baa5013..b5788e3 100644
--- a/firmware/2lib/2misc.c
+++ b/firmware/2lib/2misc.c
@@ -514,7 +514,19 @@
 	if (gbb->flags & VB2_GBB_FLAG_DEFAULT_DEV_BOOT_LEGACY)
 		return VB2_DEV_DEFAULT_BOOT_LEGACY;
 
-	return vb2_nv_get(ctx, VB2_NV_DEV_DEFAULT_BOOT);
+	switch (vb2_nv_get(ctx, VB2_NV_DEV_DEFAULT_BOOT)) {
+		case VB2_DEV_DEFAULT_BOOT_USB:
+			if (vb2_dev_boot_usb_allowed(ctx))
+				return VB2_DEV_DEFAULT_BOOT_USB;
+			break;
+
+		case VB2_DEV_DEFAULT_BOOT_LEGACY:
+			if (vb2_dev_boot_legacy_allowed(ctx))
+				return VB2_DEV_DEFAULT_BOOT_LEGACY;
+			break;
+	}
+
+	return VB2_DEV_DEFAULT_BOOT_DISK;
 }
 
 int vb2_dev_boot_allowed(struct vb2_context *ctx)
diff --git a/tests/vb2_misc_tests.c b/tests/vb2_misc_tests.c
index f5cc90c..aabe0ee 100644
--- a/tests/vb2_misc_tests.c
+++ b/tests/vb2_misc_tests.c
@@ -872,15 +872,39 @@
 
 	/* Boot from usb */
 	reset_common_data();
+	vb2_nv_set(ctx, VB2_NV_DEV_BOOT_USB, 1);
 	vb2_nv_set(ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_USB);
 	TEST_EQ(vb2_get_dev_boot_target(ctx),
 		VB2_DEV_DEFAULT_BOOT_USB, "set default boot usb");
 
+	/* Boot from usb not allowed */
+	reset_common_data();
+	vb2_nv_set(ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_USB);
+	TEST_EQ(vb2_get_dev_boot_target(ctx),
+		VB2_DEV_DEFAULT_BOOT_DISK, "default boot usb not allowed");
+	reset_common_data();
+	vb2_nv_set(ctx, VB2_NV_DEV_BOOT_LEGACY, 1);
+	vb2_nv_set(ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_USB);
+	TEST_EQ(vb2_get_dev_boot_target(ctx),
+		VB2_DEV_DEFAULT_BOOT_DISK, "default boot usb not allowed");
+
 	/* Boot legacy */
 	reset_common_data();
+	vb2_nv_set(ctx, VB2_NV_DEV_BOOT_LEGACY, 1);
 	vb2_nv_set(ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_LEGACY);
 	TEST_EQ(vb2_get_dev_boot_target(ctx),
 		VB2_DEV_DEFAULT_BOOT_LEGACY, "set default boot legacy");
+
+	/* Boot legacy not allowed */
+	reset_common_data();
+	vb2_nv_set(ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_LEGACY);
+	TEST_EQ(vb2_get_dev_boot_target(ctx),
+		VB2_DEV_DEFAULT_BOOT_DISK, "default boot legacy not allowed");
+	reset_common_data();
+	vb2_nv_set(ctx, VB2_NV_DEV_BOOT_USB, 1);
+	vb2_nv_set(ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_LEGACY);
+	TEST_EQ(vb2_get_dev_boot_target(ctx),
+		VB2_DEV_DEFAULT_BOOT_DISK, "default boot legacy not allowed");
 }
 
 static void dev_boot_allowed_tests(void)