diff --git a/firmware/2lib/2kernel.c b/firmware/2lib/2kernel.c
index 0fa1a6f..8c6d191 100644
--- a/firmware/2lib/2kernel.c
+++ b/firmware/2lib/2kernel.c
@@ -148,7 +148,7 @@
 		flags = vb2_secdata_kernel_get(ctx, VB2_SECDATA_KERNEL_FLAGS);
 		flags &= ~VB2_SECDATA_KERNEL_FLAG_PHONE_RECOVERY_DISABLED;
 		flags |= VB2_SECDATA_KERNEL_FLAG_PHONE_RECOVERY_UI_DISABLED;
-		flags |= VB2_SECDATA_KERNEL_FLAG_DIAGNOSTIC_UI_DISABLED;
+		flags &= ~VB2_SECDATA_KERNEL_FLAG_DIAGNOSTIC_UI_DISABLED;
 		flags |= VB2_SECDATA_KERNEL_FLAG_HWCRYPTO_ALLOWED;
 		vb2_secdata_kernel_set(ctx, VB2_SECDATA_KERNEL_FLAGS, flags);
 	}
diff --git a/tests/vb2_kernel_tests.c b/tests/vb2_kernel_tests.c
index 67b6b48..4b0a249 100644
--- a/tests/vb2_kernel_tests.c
+++ b/tests/vb2_kernel_tests.c
@@ -223,9 +223,9 @@
 		"  phone recovery enabled");
 	TEST_EQ(vb2api_phone_recovery_ui_enabled(ctx), 0,
 		"  phone recovery ui disabled");
-	/* Make sure diagnostic UI is disabled */
-	TEST_EQ(vb2api_diagnostic_ui_enabled(ctx), 0,
-		"  diagnostic ui disabled");
+	/* Make sure diagnostic UI is enabled */
+	TEST_EQ(vb2api_diagnostic_ui_enabled(ctx), 1,
+		"  diagnostic ui enabled");
 
 	/*
 	 * Test flags are unchanged for experimental features in recovery path