diff --git a/rust/Makefile b/rust/Makefile
index 87172eae..07686cb9 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -114,6 +114,7 @@ ifneq ($(HAVE_DRACUT),0)
 	$(INSTALL) -m 755 pvebc/$(SEL_EBC_MODDIR)/module-setup.sh \
 		pvebc/$(SEL_EBC_MODDIR)/override-crypttab.sh \
 		pvebc/$(SEL_EBC_MODDIR)/pvebc-wrapper.sh \
+		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-modules.conf \
 		$(DESTDIR)$(DRACUTMODDIR)/$(SEL_EBC_MODDIR)
 	$(INSTALL) -m 644 pvebc/$(SEL_EBC_MODDIR)/boot.mount \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-override-crypttab.service \
diff --git a/rust/pvebc/95sel-ebc/module-setup.sh b/rust/pvebc/95sel-ebc/module-setup.sh
index 52673112..d804f6fd 100644
--- a/rust/pvebc/95sel-ebc/module-setup.sh
+++ b/rust/pvebc/95sel-ebc/module-setup.sh
@@ -23,11 +23,11 @@ depends() {
 # Called by dracut
 installkernel() {
 	# kernel modules needed for opening an encrypted rfs
-	instmods -c uvdevice
-	instmods -c paes_s390
-	instmods -c pkey_uv
-	instmods -c pkey_pckmo
-	instmods -c pkey
+	hostonly='' instmods -c uvdevice
+	hostonly='' instmods -c paes_s390
+	hostonly='' instmods -c pkey_uv
+	hostonly='' instmods -c pkey_pckmo
+	hostonly='' instmods -c pkey
 }
 
 # Called by dracut
@@ -58,6 +58,10 @@ install() {
 	inst_simple "$moddir/override-crypttab.sh" \
 		"/etc/sel-ebc/override-crypttab.sh"
 
+	# install kernel module dependencies
+	inst_simple "$moddir/sel-ebc-modules.conf" \
+		"/usr/lib/modules-load.d/sel-ebc-modules.conf"
+
 	# copy main application
 	inst_binary "/usr/bin/pvebc"
 	inst_binary "/usr/bin/pvsecret"
diff --git a/rust/pvebc/95sel-ebc/sel-ebc-modules.conf b/rust/pvebc/95sel-ebc/sel-ebc-modules.conf
new file mode 100644
index 00000000..d4a0e4eb
--- /dev/null
+++ b/rust/pvebc/95sel-ebc/sel-ebc-modules.conf
@@ -0,0 +1,5 @@
+uvdevice
+paes_s390
+pkey_uv
+pkey_pckmo
+pkey