diff --git a/dracut-early-kdump.sh b/dracut-early-kdump.sh
index 6788a6b83431c74eb99e85f39808ec5d99cb72c8..69a34eb996cd0b365d488d08797f0d43189930d3 100755
--- a/dracut-early-kdump.sh
+++ b/dracut-early-kdump.sh
@@ -2,7 +2,6 @@
 
 KEXEC=/sbin/kexec
 standard_kexec_args="-p"
-KDUMP_FILE_LOAD=""
 
 EARLY_KDUMP_INITRD=""
 EARLY_KDUMP_KERNEL=""
@@ -44,8 +43,8 @@ early_kdump_load()
 
     EARLY_KEXEC_ARGS=$(prepare_kexec_args "${KEXEC_ARGS}")
 
-    if [ "$KDUMP_FILE_LOAD" == "on" ]; then
-        echo "Using kexec file based syscall."
+    if is_secure_boot_enforced; then
+        echo "Secure Boot is enabled. Using kexec file based syscall."
         EARLY_KEXEC_ARGS="$EARLY_KEXEC_ARGS -s"
     fi
 
diff --git a/kdump-lib.sh b/kdump-lib.sh
index 9d0779d511ef23a11d5db62c8eaf48b3c5235878..6600fa0c874a129188de9e51e48799bdebdf631d 100755
--- a/kdump-lib.sh
+++ b/kdump-lib.sh
@@ -558,6 +558,35 @@ need_64bit_headers()
     print (strtonum("0x" r[2]) > strtonum("0xffffffff")); }'`
 }
 
+# Check if secure boot is being enforced.
+#
+# Per Peter Jones, we need check efivar SecureBoot-$(the UUID) and
+# SetupMode-$(the UUID), they are both 5 bytes binary data. The first four
+# bytes are the attributes associated with the variable and can safely be
+# ignored, the last bytes are one-byte true-or-false variables. If SecureBoot
+# is 1 and SetupMode is 0, then secure boot is being enforced.
+#
+# Assume efivars is mounted at /sys/firmware/efi/efivars.
+is_secure_boot_enforced()
+{
+    local secure_boot_file setup_mode_file
+    local secure_boot_byte setup_mode_byte
+
+    secure_boot_file=$(find /sys/firmware/efi/efivars -name SecureBoot-* 2>/dev/null)
+    setup_mode_file=$(find /sys/firmware/efi/efivars -name SetupMode-* 2>/dev/null)
+
+    if [ -f "$secure_boot_file" ] && [ -f "$setup_mode_file" ]; then
+        secure_boot_byte=$(hexdump -v -e '/1 "%d\ "' $secure_boot_file|cut -d' ' -f 5)
+        setup_mode_byte=$(hexdump -v -e '/1 "%d\ "' $setup_mode_file|cut -d' ' -f 5)
+
+        if [ "$secure_boot_byte" = "1" ] && [ "$setup_mode_byte" = "0" ]; then
+            return 0
+        fi
+    fi
+
+    return 1
+}
+
 #
 # prepare_kexec_args <kexec args>
 # This function prepares kexec argument.
diff --git a/kdump.sysconfig.x86_64 b/kdump.sysconfig.x86_64
index 82172047864aec4d73766b4b9bd7323f3f3a101d..09de2ebe798e32bb4e22d0c9f1427171da65da4e 100644
--- a/kdump.sysconfig.x86_64
+++ b/kdump.sysconfig.x86_64
@@ -38,9 +38,3 @@ KDUMP_IMG="vmlinuz"
 
 #What is the images extension.  Relocatable kernels don't have one
 KDUMP_IMG_EXT=""
-
-# Using kexec file based syscall by default
-#
-# Here, the "on" is the only valid value to enable the kexec file load and
-# anything else is equal to the "off"(disable).
-KDUMP_FILE_LOAD="off"
diff --git a/kdumpctl b/kdumpctl
index fc50b2a7412a65604aba396deb835f4ce59617d0..e985097cd08fa48f3d179f1e6c71ed3c9045d262 100755
--- a/kdumpctl
+++ b/kdumpctl
@@ -4,7 +4,6 @@ KEXEC=/sbin/kexec
 KDUMP_KERNELVER=""
 KDUMP_COMMANDLINE=""
 KEXEC_ARGS=""
-KDUMP_FILE_LOAD=""
 KDUMP_CONFIG_FILE="/etc/kdump.conf"
 MKDUMPRD="/sbin/mkdumprd -f"
 DRACUT_MODULES_FILE="/usr/lib/dracut/modules.txt"
@@ -680,8 +679,11 @@ load_kdump()
 	KEXEC_ARGS=$(prepare_kexec_args "${KEXEC_ARGS}")
 	KDUMP_COMMANDLINE=$(prepare_cmdline "${KDUMP_COMMANDLINE}" "${KDUMP_COMMANDLINE_REMOVE}" "${KDUMP_COMMANDLINE_APPEND}")
 
-	if [ "$KDUMP_FILE_LOAD" == "on" ]; then
-		echo "Using kexec file based syscall."
+	# For secureboot enabled machines, use new kexec file based syscall.
+	# Old syscall will always fail as it does not have capability to
+	# to kernel signature verification.
+	if is_secure_boot_enforced; then
+		echo "Secure Boot is enabled. Using kexec file based syscall."
 		KEXEC_ARGS="$KEXEC_ARGS -s"
 	fi
 
@@ -693,9 +695,6 @@ load_kdump()
 		return 0
 	else
 		echo "kexec: failed to load kdump kernel" >&2
-		if [ "$KDUMP_FILE_LOAD" == "on" ]; then
-			echo "kexec_file_load() failed, please try kexec_load()" >&2
-		fi
 		return 1
 	fi
 }
@@ -1156,7 +1155,7 @@ stop_fadump()
 
 stop_kdump()
 {
-	if [ "$KDUMP_FILE_LOAD" == "on" ]; then
+	if is_secure_boot_enforced; then
 		$KEXEC -s -p -u
 	else
 		$KEXEC -p -u
diff --git a/kexec-tools.spec b/kexec-tools.spec
index 4a3bb36566b451822ee1c2bd3175d10b1df103ab..44b99040b89b63426f89c9a30f514c577597eb54 100644
--- a/kexec-tools.spec
+++ b/kexec-tools.spec
@@ -4,7 +4,7 @@
 
 Name: kexec-tools
 Version: 2.0.26
-Release: 11
+Release: 14
 License: GPLv2
 Summary: The kexec/kdump userspace component
 URL:     https://www.kernel.org/
@@ -296,6 +296,9 @@ done
 %endif
 
 %changelog
+* Fri Jul 4 2025 zhangjian <zhangjian496@huawei.com> - 2.0.26-14
+- force use secure boot in kdump
+
 * Mon Mar 31 2025 Gu Zitao <guzitao@wxiat.com> - 2.0.26-11
 - kdump: add sw64 support