diff --git a/elfloader-tool/src/arch-arm/sys_boot.c b/elfloader-tool/src/arch-arm/sys_boot.c
index 5b49d2a5..ff8c5ad5 100644
--- a/elfloader-tool/src/arch-arm/sys_boot.c
+++ b/elfloader-tool/src/arch-arm/sys_boot.c
@@ -238,6 +238,9 @@ void continue_boot(int was_relocated)
         printf("Jumping to kernel-image entry point...\n\n");
     }
 
+    /* Clear D&A in DAIF */
+    asm volatile("msr daifclr, #0xC\n\t");
+
     /* Jump to the kernel. Note: Our DTB is smaller than 4 GiB. */
     ((init_arm_kernel_t)kernel_info.virt_entry)(user_info.phys_region_start,
                                                 user_info.phys_region_end,
diff --git a/elfloader-tool/src/binaries/efi/efi_init.c b/elfloader-tool/src/binaries/efi/efi_init.c
index a177c083..c55fb090 100644
--- a/elfloader-tool/src/binaries/efi/efi_init.c
+++ b/elfloader-tool/src/binaries/efi/efi_init.c
@@ -4,18 +4,28 @@
  * SPDX-License-Identifier: GPL-2.0-only
  */
 
+#include <autoconf.h>
 #include <binaries/efi/efi.h>
 #include <elfloader_common.h>
 
 void *__application_handle = NULL;             // current efi application handler
 efi_system_table_t *__efi_system_table = NULL; // current efi system table
 
+static unsigned long efi_exit_bs_result = EFI_SUCCESS;
+static unsigned long exit_boot_services(void);
+
+unsigned long efi_exit_boot_services(void)
+{
+    return efi_exit_bs_result;
+}
+
 extern void _start(void);
 unsigned int efi_main(uintptr_t application_handle, uintptr_t efi_system_table)
 {
     clear_bss();
     __application_handle = (void *)application_handle;
     __efi_system_table = (efi_system_table_t *)efi_system_table;
+    efi_exit_bs_result = exit_boot_services();
     _start();
     return 0;
 }
@@ -41,7 +51,7 @@ void *efi_get_fdt(void)
  * This means boot time services are not available anymore. We should store
  * system information e.g. current memory map and pass them to kernel.
  */
-unsigned long efi_exit_boot_services(void)
+static unsigned long exit_boot_services(void)
 {
     unsigned long status;
     efi_memory_desc_t *memory_map;
@@ -78,5 +88,11 @@ unsigned long efi_exit_boot_services(void)
     }
 
     status = bts->exit_boot_services(__application_handle, key);
+
+#if defined(CONFIG_ARCH_AARCH64)
+    /* Now that we're free, mask all exceptions until we enter the kernel */
+    asm volatile("msr daifset, #0xF\n\t");
+#endif
+
     return status;
 }