diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9b48f78..22c4421a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Release history for s390-tools (MIT version)
   Add new tools / libraries:
 
   Changes of existing tools:
+  - genprotimg: add support for add-secret requests
 
   Bug Fixes:
 
diff --git a/genprotimg/man/genprotimg.1 b/genprotimg/man/genprotimg.1
index cf8bfcc1..e1c5fbf9 100644
--- a/genprotimg/man/genprotimg.1
+++ b/genprotimg/man/genprotimg.1
@@ -97,9 +97,10 @@ Do not use for a production image unless you verified
 the host-key document before. Optional.
 .TP
 \fB\-\-comm\-key\fR=\fI\,FILE\/\fR
-Specifies the customer communication key (CCK). This key is used among
-other things for the PV guest dump encryption. Use a secure, random,
-plaintext AES-256 GCM key. Optional.
+Specifies the customer communication key (CCK). This key is used for the
+PV guest dump encryption and to derive the CCK-derived extension secret
+used for add-secret requests. Use a secure, random, plaintext AES-256
+GCM key. Optional.
 .TP
 \fB\-\-enable\-dump\fR
 Enable PV guest dumps. Requires the \fB\-\-comm\-key\fR option. Optional.
@@ -107,6 +108,15 @@ Enable PV guest dumps. Requires the \fB\-\-comm\-key\fR option. Optional.
 \fB\-\-disable\-dump\fR
 Disable PV guest dumps. This is the default.
 .TP
+\fB\-\-enable\-cck\-extension\-secret\fR
+Add-secret requests must provide an extension secret that matches the
+CCK-derived extension secret. Requires the \fB\-\-comm\-key\fR option.
+Optional.
+.TP
+\fB\-\-disable\-cck\-extension\-secret\fR
+Add-secret requests don't have to provide an extension secret. This is
+the default.
+.TP
 \fB\-\-enable\-pckmo\fR
 Enable the support for the DEA, TDEA, AES, and ECC PCKMO key encryption
 functions. This is the default.
diff --git a/genprotimg/src/include/pv_hdr_def.h b/genprotimg/src/include/pv_hdr_def.h
index 6fc04d4c..ecb482fd 100644
--- a/genprotimg/src/include/pv_hdr_def.h
+++ b/genprotimg/src/include/pv_hdr_def.h
@@ -34,6 +34,10 @@
 #define PV_PCF_PCKMO_AES	__PV_BIT(57) /* PCKMO encrypt-AES-key functions allowed */
 #define PV_PCF_PCKM_ECC	__PV_BIT(58) /* PCKMO encrypt-ECC-key functions allowed */
 
+/* Secret control flags */
+#define PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT                                                     \
+	__PV_BIT(1) /* All add-secret requests must provide an extension secret */
+
 /* maxima for the PV version 1 */
 #define PV_V1_IPIB_MAX_SIZE	PAGE_SIZE
 #define PV_V1_PV_HDR_MAX_SIZE	(2 * PAGE_SIZE)
diff --git a/genprotimg/src/pv/pv_args.c b/genprotimg/src/pv/pv_args.c
index b5b945d0..67ddc398 100644
--- a/genprotimg/src/pv/pv_args.c
+++ b/genprotimg/src/pv/pv_args.c
@@ -75,6 +75,13 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
 		return -1;
 	}
 
+	if (cf_args->scf && !(cf_args->enable_cck_extension_secret_enforcement == PV_NOT_SET)) {
+		g_set_error(
+			err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
+			_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
+		return -1;
+	}
+
 	/* Check for unused arguments */
 	if (args->unused_values->len > 0) {
 		g_autofree gchar *unused = NULL;
@@ -100,6 +107,14 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
 			      "--help' for more information"));
 		return -1;
 	}
+	if (cf_args->enable_cck_extension_secret_enforcement == PV_TRUE &&
+	    !args->cust_comm_key_path) {
+		g_set_error(
+			err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+			_("Option '--enable-cck-extension-secret' requires the '--comm-key' option.\nUse 'genprotimg "
+			  "--help' for more information"));
+		return -1;
+	}
 
 	if (!args->output_path) {
 		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
@@ -254,11 +269,12 @@ static gboolean cb_remaining_values(const gchar *option G_GNUC_UNUSED,
 		.description = DISABLE_DESC,                                                       \
 	}
 
-#define INDENT "                                   "
+#define INDENT "                                     "
 
 /* Define the callbacks for mutually exclusive command line flags */
 DEFINE_MUT_EXCL_BOOL_FLAG_CBS(dump);
 DEFINE_MUT_EXCL_BOOL_FLAG_CBS(pckmo);
+DEFINE_MUT_EXCL_BOOL_FLAG_CBS(cck_extension_secret_enforcement);
 
 gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 			   GError **err)
@@ -328,6 +344,14 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 				   _("Enable PV guest dumps (optional). This option\n" INDENT
 				     "requires the '--comm-key' option."),
 				   _("Disable PV guest dumps (default).")),
+		MUT_EXCL_BOOL_FLAG(
+			cck-extension-secret, cck_extension_secret_enforcement,
+			_("Add-secret requests must provide an extension\n" INDENT
+			  "secret that matches the CCK-derived extension\n" INDENT
+			  "secret (optional). This option requires the\n" INDENT
+			  "'--comm-key' option."),
+			_("Add-secret requests don't have to provide\n" INDENT
+			  "the CCK-derived extension secret (default).")),
 		MUT_EXCL_BOOL_FLAG(pckmo, pckmo,
 				   _("Enable the support for the DEA, TDEA, AES, and\n" INDENT
 				     "ECC PCKMO key encryption functions (default)."),
@@ -445,6 +469,8 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 		  .arg_data = cb_set_string_option,
 		  .description = _("Specify the secret control flags\n" INDENT
 				   "as a hexadecimal value.\n" INDENT
+				   "Optional; mutually exclusive with\n" INDENT
+				   "'--(enable|disable)-cck-extension-secret';\n" INDENT
 				   "Optional; default: '0x0'."),
 		  .arg_description = _("VALUE") },
 		{ 0 },
diff --git a/genprotimg/src/pv/pv_args.h b/genprotimg/src/pv/pv_args.h
index 5a46367f..87fbe425 100644
--- a/genprotimg/src/pv/pv_args.h
+++ b/genprotimg/src/pv/pv_args.h
@@ -33,6 +33,8 @@ STATIC_ASSERT(PV_NOT_SET == 0)
 typedef struct {
 	gchar *pcf;
 	gchar *scf;
+	/* Add-secret requests do require CCK-extension secrets */
+	PvTristate enable_cck_extension_secret_enforcement;
 	PvTristate enable_dump;
 	PvTristate enable_pckmo;
 } PvControlFlagsArgs;
diff --git a/genprotimg/src/pv/pv_image.c b/genprotimg/src/pv/pv_image.c
index 6c8b6e22..75aeb5e4 100644
--- a/genprotimg/src/pv/pv_image.c
+++ b/genprotimg/src/pv/pv_image.c
@@ -260,6 +260,8 @@ static gint pv_img_set_control_flags(PvImage *img, const PvControlFlagsArgs *cf_
 		img->scf = flags;
 	}
 
+	pv_img_set_control_flag(&img->scf, cf_args->enable_cck_extension_secret_enforcement,
+				PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT);
 	return 0;
 }