diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h
index c6b4f0603024332948677b9ec9606d201ac32b28..b112a11e93024f4cff245b294fdf48637cd01f6d 100644
--- a/arch/arm64/include/asm/pointer_auth.h
+++ b/arch/arm64/include/asm/pointer_auth.h
@@ -76,6 +76,15 @@ static inline unsigned long ptrauth_strip_insn_pac(unsigned long ptr)
 	return ptrauth_clear_pac(ptr);
 }
 
+static __always_inline void ptrauth_enable(void)
+{
+	if (!system_supports_address_auth())
+		return;
+	sysreg_clear_set(sctlr_el1, 0, (SCTLR_ELx_ENIA | SCTLR_ELx_ENIB |
+					SCTLR_ELx_ENDA | SCTLR_ELx_ENDB));
+	isb();
+}
+
 #define ptrauth_thread_init_user(tsk)					\
 	ptrauth_keys_init_user(&(tsk)->thread.keys_user)
 #define ptrauth_thread_init_kernel(tsk)					\
@@ -84,6 +93,7 @@ static inline unsigned long ptrauth_strip_insn_pac(unsigned long ptr)
 	ptrauth_keys_switch_kernel(&(tsk)->thread.keys_kernel)
 
 #else /* CONFIG_ARM64_PTR_AUTH */
+#define ptrauth_enable()
 #define ptrauth_prctl_reset_keys(tsk, arg)	(-EINVAL)
 #define ptrauth_strip_insn_pac(lr)	(lr)
 #define ptrauth_thread_init_user(tsk)
diff --git a/arch/arm64/include/asm/stackprotector.h b/arch/arm64/include/asm/stackprotector.h
index 7263e0bac680789cfa244802a2c72fd24c0a3fa3..33f1bb4531509ceb6665d98488892f6da30ddac6 100644
--- a/arch/arm64/include/asm/stackprotector.h
+++ b/arch/arm64/include/asm/stackprotector.h
@@ -41,6 +41,7 @@ static __always_inline void boot_init_stack_canary(void)
 #endif
 	ptrauth_thread_init_kernel(current);
 	ptrauth_thread_switch_kernel(current);
+	ptrauth_enable();
 }
 
 #endif	/* _ASM_STACKPROTECTOR_H */
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 90700ce19e663395ee2cad42a1554f333f882f21..2313398c510cc3bf53e27d48629369e3358d9d72 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1685,10 +1685,27 @@ static void cpu_clear_disr(const struct arm64_cpu_capabilities *__unused)
 #endif /* CONFIG_ARM64_RAS_EXTN */
 
 #ifdef CONFIG_ARM64_PTR_AUTH
+/*
+ * PAuth is enabled by default, and should be explicitly shut down by
+ * `arm64.nopauth` if needed.
+ */
+static int arm64_nopauth __ro_after_init;
+
+static int __init parse_arm64_nopauth(char *str)
+{
+	arm64_nopauth = 1;
+
+	return 0;
+}
+early_param("arm64.nopauth", parse_arm64_nopauth);
+
 static bool has_address_auth_cpucap(const struct arm64_cpu_capabilities *entry, int scope)
 {
 	int boot_val, sec_val;
 
+	if (arm64_nopauth)
+		return false;
+
 	/* We don't expect to be called with SCOPE_SYSTEM */
 	WARN_ON(scope == SCOPE_SYSTEM);
 	/*
@@ -1718,6 +1735,12 @@ static bool has_address_auth_metacap(const struct arm64_cpu_capabilities *entry,
 	       has_address_auth_cpucap(cpu_hwcaps_ptrs[ARM64_HAS_ADDRESS_AUTH_IMP_DEF], scope);
 }
 
+static bool has_ptr_auth_cpucap(const struct arm64_cpu_capabilities *entry,
+				int scope)
+{
+	return !arm64_nopauth && has_cpuid_feature(entry, scope);
+}
+
 static bool has_generic_auth(const struct arm64_cpu_capabilities *entry,
 			     int __unused)
 {
@@ -2169,7 +2192,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 		.sign = FTR_UNSIGNED,
 		.field_pos = ID_AA64ISAR1_GPA_SHIFT,
 		.min_field_value = ID_AA64ISAR1_GPA_ARCHITECTED,
-		.matches = has_cpuid_feature,
+		.matches = has_ptr_auth_cpucap,
 	},
 	{
 		.desc = "Generic authentication (IMP DEF algorithm)",
@@ -2179,7 +2202,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 		.sign = FTR_UNSIGNED,
 		.field_pos = ID_AA64ISAR1_GPI_SHIFT,
 		.min_field_value = ID_AA64ISAR1_GPI_IMP_DEF,
-		.matches = has_cpuid_feature,
+		.matches = has_ptr_auth_cpucap,
 	},
 	{
 		.capability = ARM64_HAS_GENERIC_AUTH,
@@ -2305,6 +2328,13 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 		.sign = s,							\
 		.min_field_value = min_value,
 
+#define HWCAP_CPUID_MATCH_SELF_DEFINED(match, reg, field, s, min_value)		\
+		.matches = match,					\
+		.sys_reg = reg,							\
+		.field_pos = field,						\
+		.sign = s,							\
+		.min_field_value = min_value,
+
 #define __HWCAP_CAP(name, cap_type, cap)					\
 		.desc = name,							\
 		.type = ARM64_CPUCAP_SYSTEM_FEATURE,				\
@@ -2333,24 +2363,28 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 #ifdef CONFIG_ARM64_PTR_AUTH
 static const struct arm64_cpu_capabilities ptr_auth_hwcap_addr_matches[] = {
 	{
-		HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_APA_SHIFT,
-				  FTR_UNSIGNED, ID_AA64ISAR1_APA_ARCHITECTED)
+		HWCAP_CPUID_MATCH_SELF_DEFINED(has_ptr_auth_cpucap,
+				SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_APA_SHIFT,
+				FTR_UNSIGNED, ID_AA64ISAR1_APA_ARCHITECTED)
 	},
 	{
-		HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_API_SHIFT,
-				  FTR_UNSIGNED, ID_AA64ISAR1_API_IMP_DEF)
+		HWCAP_CPUID_MATCH_SELF_DEFINED(has_ptr_auth_cpucap,
+				SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_API_SHIFT,
+				FTR_UNSIGNED, ID_AA64ISAR1_API_IMP_DEF)
 	},
 	{},
 };
 
 static const struct arm64_cpu_capabilities ptr_auth_hwcap_gen_matches[] = {
 	{
-		HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_GPA_SHIFT,
-				  FTR_UNSIGNED, ID_AA64ISAR1_GPA_ARCHITECTED)
+		HWCAP_CPUID_MATCH_SELF_DEFINED(has_ptr_auth_cpucap,
+				SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_GPA_SHIFT,
+				FTR_UNSIGNED, ID_AA64ISAR1_GPA_ARCHITECTED)
 	},
 	{
-		HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_GPI_SHIFT,
-				  FTR_UNSIGNED, ID_AA64ISAR1_GPI_IMP_DEF)
+		HWCAP_CPUID_MATCH_SELF_DEFINED(has_ptr_auth_cpucap,
+				SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_GPI_SHIFT,
+				FTR_UNSIGNED, ID_AA64ISAR1_GPI_IMP_DEF)
 	},
 	{},
 };
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 6e3f04b12bcb881d3cc01be7a1e3e295f0f1e7c4..2bcefd7e5347f33d669ea81ced53467b52b26067 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -420,10 +420,6 @@ SYM_FUNC_START_LOCAL(__primary_switched)
 	adr_l	x5, init_task
 	msr	sp_el0, x5			// Save thread_info
 
-#ifdef CONFIG_ARM64_PTR_AUTH
-	__ptrauth_keys_init_cpu	x5, x6, x7, x8
-#endif
-
 	adr_l	x8, vectors			// load VBAR_EL1 with virtual
 	msr	vbar_el1, x8			// vector table address
 	isb