diff --git a/arch/arm/cpu/armv7/qca/common/scm.c b/arch/arm/cpu/armv7/qca/common/scm.c
index 851ed3cc0d..0ca772b506 100644
--- a/arch/arm/cpu/armv7/qca/common/scm.c
+++ b/arch/arm/cpu/armv7/qca/common/scm.c
@@ -351,6 +351,7 @@ bool is_scm_armv8(void)
         return (scm_version == SCM_ARMV8_32);
 }
 
+#ifndef CONFIG_DISABLE_KERNEL64
 void __attribute__ ((noreturn)) jump_kernel64(void *kernel_entry,
 				void *fdt_addr)
 {
@@ -377,8 +378,9 @@ void __attribute__ ((noreturn)) jump_kernel64(void *kernel_entry,
 	printf("Can't boot kernel: %d\n", ret);
 	hang();
 }
+#endif
 
-
+#ifndef CONFIG_CMD_DISABLE_EXECTZT
 void __attribute__ ((noreturn)) execute_tzt(void *entry_addr)
 {
         struct qca_scm_desc desc = {0};
@@ -398,7 +400,7 @@ void __attribute__ ((noreturn)) execute_tzt(void *entry_addr)
         printf("Can't boot TZT: %d\n", ret);
         hang();
 }
-
+#endif
 
 /* We need to invalidate the buffer written by TZ before we use in u-boot
  * In some calls TZ writes to desc.args[0].
diff --git a/arch/arm/include/asm/arch-qca-common/scm.h b/arch/arm/include/asm/arch-qca-common/scm.h
index c83d81fa5a..eb727e885f 100644
--- a/arch/arm/include/asm/arch-qca-common/scm.h
+++ b/arch/arm/include/asm/arch-qca-common/scm.h
@@ -226,9 +226,12 @@ typedef struct {
 #define	SCM_RW_OP   2
 #define	SCM_BUF_VAL 3
 
+#ifndef CONFIG_DISABLE_KERNEL64
 void __attribute__ ((noreturn)) jump_kernel64(void *kernel_entry,
 		void *fdt_addr);
+#endif
 
-
+#ifndef CONFIG_CMD_DISABLE_EXECTZT
 void __attribute__ ((noreturn)) execute_tzt(void *entry_addr);
 #endif
+#endif
diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
index a2c2dc6dce..0c6805704c 100644
--- a/arch/arm/lib/bootm.c
+++ b/arch/arm/lib/bootm.c
@@ -259,6 +259,7 @@ bool armv7_boot_nonsec(void)
 }
 #endif
 
+#ifndef CONFIG_DISABLE_KERNEL64
 struct aarch64_hdr {
 	u32 code0; /* Executable code */
 	u32 code1; /* Executable code */
@@ -273,6 +274,7 @@ struct aarch64_hdr {
 };
 #define AARCH64_LINUX_MAGIC 0x644d5241
 #define TEST_AARCH64(ptr) (ptr->magic == AARCH64_LINUX_MAGIC) ? true : false
+#endif
 
 /* Subcommand: GO */
 static void boot_jump_linux(bootm_headers_t *images, int flag)
@@ -323,9 +325,11 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
 	else
 		r2 = gd->bd->bi_boot_params;
 
+#ifndef CONFIG_DISABLE_KERNEL64
 	if (TEST_AARCH64(((struct aarch64_hdr *)kernel_entry))) {
 		jump_kernel64(kernel_entry, images->ft_addr);
 	} else {
+#endif
 		if (!fake) {
 #ifdef CONFIG_ARMV7_NONSEC
 			if (armv7_boot_nonsec()) {
@@ -336,8 +340,10 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
 #endif
 				kernel_entry(0, machid, r2);
 		}
+#ifndef CONFIG_DISABLE_KERNEL64
 	}
 #endif
+#endif
 }
 
 /* Main Entry point for arm bootm implementation
diff --git a/board/qca/arm/common/Makefile b/board/qca/arm/common/Makefile
index ba385d109b..0ddd2ca3f4 100644
--- a/board/qca/arm/common/Makefile
+++ b/board/qca/arm/common/Makefile
@@ -1,7 +1,9 @@
 obj-y := cmd_bootqca.o
 obj-y += cmd_blowsecfuse.o
 obj-y += cmd_sec_auth.o
+ifndef CONFIG_CMD_DISABLE_EXECTZT
 obj-y += cmd_exectzt.o
+endif
 obj-$(CONFIG_IPQ_TZT) += cmd_tzt.o
 obj-$(CONFIG_SMP_CMD_SUPPORT) += cmd_runmulticore.o
 obj-y += fdt_info.o
diff --git a/board/qca/arm/ipq5018/ipq5018.c b/board/qca/arm/ipq5018/ipq5018.c
index 211c981178..e03cb35b74 100644
--- a/board/qca/arm/ipq5018/ipq5018.c
+++ b/board/qca/arm/ipq5018/ipq5018.c
@@ -2063,10 +2063,12 @@ void fdt_fixup_art_format(void *blob)
 }
 #endif
 
+#ifndef CONFIG_CMD_DISABLE_EXECTZT
 void run_tzt(void *address)
 {
 	execute_tzt(address);
 }
+#endif
 
 void fdt_fixup_set_dload_warm_reset(void *blob)
 {
diff --git a/board/qca/arm/ipq807x/ipq807x.c b/board/qca/arm/ipq807x/ipq807x.c
index 3c3b6ad4a4..ba78fd61c7 100644
--- a/board/qca/arm/ipq807x/ipq807x.c
+++ b/board/qca/arm/ipq807x/ipq807x.c
@@ -1841,10 +1841,12 @@ int bring_sec_core_up(unsigned int cpuid, unsigned int entry, unsigned int arg)
 	return 0;
 }
 
+#ifndef CONFIG_CMD_DISABLE_EXECTZT
 void run_tzt(void *address)
 {
 	execute_tzt(address);
 }
+#endif
 
 void sdi_disable(void)
 {
diff --git a/include/configs/ipq5332.h b/include/configs/ipq5332.h
index 0d237b26da..4bd5675dde 100644
--- a/include/configs/ipq5332.h
+++ b/include/configs/ipq5332.h
@@ -449,6 +449,8 @@ extern loff_t board_env_size;
 #define CONFIG_DISABLE_CMD_SF_PROTECT
 #define CONFIG_DISABLE_CMD_SF_BULKERASE
 #define CONFIG_DISABLE_CMD_UART
+#define CONFIG_DISABLE_KERNEL64
+#define CONFIG_CMD_DISABLE_EXECTZT
 #else
 #define CONFIG_IPQ_ELF_AUTH
 #endif