diff --git a/3rdparty/vboot b/3rdparty/vboot
index b76cd8c806a..def2f5af7ac 160000
--- a/3rdparty/vboot
+++ b/3rdparty/vboot
@@ -1 +1 @@
-Subproject commit b76cd8c806a47ca42b4df67b547a1d3fb0093a22
+Subproject commit def2f5af7ac03eac3a4a79795275f1cf6cd7f827
diff --git a/configs/config.protectli_vp2420 b/configs/config.protectli_vp2420
index d3fb50bc718..dd8aaf31c6f 100644
--- a/configs/config.protectli_vp2420
+++ b/configs/config.protectli_vp2420
@@ -32,7 +32,7 @@ CONFIG_POST_DEVICE_LPC=y
 CONFIG_POST_IO_PORT=0x80
 CONFIG_PAYLOAD_EDK2=y
 CONFIG_EDK2_REPOSITORY="https://github.com/Dasharo/edk2"
-CONFIG_EDK2_TAG_OR_REV="746b760876708faf438b2d89cfeb4b3798606d5f"
+CONFIG_EDK2_TAG_OR_REV="91d01a5e577475894e7cce06d59e392cbbffba22"
 CONFIG_EDK2_USE_EDK2_PLATFORMS=y
 CONFIG_EDK2_PLATFORMS_REPOSITORY="https://github.com/Dasharo/edk2-platforms"
 CONFIG_EDK2_PLATFORMS_TAG_OR_REV="3323ed481d35096fb6a7eae7b49f35eff00f86cf"
diff --git a/src/mainboard/protectli/vault_ehl/Kconfig b/src/mainboard/protectli/vault_ehl/Kconfig
index 2110ff42285..6ffb340791c 100644
--- a/src/mainboard/protectli/vault_ehl/Kconfig
+++ b/src/mainboard/protectli/vault_ehl/Kconfig
@@ -46,6 +46,7 @@ config VBOOT
 	select VBOOT_VBNV_CMOS
 	select VBOOT_VBNV_CMOS_BACKUP_TO_FLASH
 	select VBOOT_SEPARATE_VERSTAGE
+	select HAS_RECOVERY_MRC_CACHE
 
 config VBOOT_SLOTS_RW_A
 	default y if VBOOT
diff --git a/src/mainboard/protectli/vault_ehl/mainboard.c b/src/mainboard/protectli/vault_ehl/mainboard.c
index 8c75b38b7e9..cc14b775fd4 100644
--- a/src/mainboard/protectli/vault_ehl/mainboard.c
+++ b/src/mainboard/protectli/vault_ehl/mainboard.c
@@ -3,14 +3,10 @@
 #include <device/device.h>
 #include <fsp/api.h>
 #include <pc80/i8254.h>
-#include <security/vboot/vboot_common.h>
 #include <soc/ramstage.h>
 
 static void mainboard_final(void *chip_info)
 {
-	if (CONFIG(VBOOT))
-		vboot_clear_recovery_request();
-
 	beep(1500, 200);
 }
 
diff --git a/src/security/vboot/bootmode.c b/src/security/vboot/bootmode.c
index 059d325eaed..9b21cc07c6f 100644
--- a/src/security/vboot/bootmode.c
+++ b/src/security/vboot/bootmode.c
@@ -18,22 +18,6 @@ int vboot_check_recovery_request(void)
 	return vb2api_get_recovery_reason(vboot_get_context());
 }
 
-void vboot_clear_recovery_request(void)
-{
-	struct vb2_context *ctx;
-
-	/* No point in clearing the recovery request if we are not in recovery. */
-	if (!vboot_recovery_mode_enabled())
-		return;
-
-	ctx = vboot_get_context();
-	vb2api_clear_recovery(ctx);
-	save_vbnv(ctx->nvdata);
-
-	if (CONFIG(VBOOT_VBNV_CMOS_BACKUP_TO_FLASH))
-		save_vbnv_flash(ctx->nvdata);
-}
-
 int vboot_recovery_mode_enabled(void)
 {
 	return vboot_get_context()->flags & VB2_CONTEXT_RECOVERY_MODE;
@@ -68,6 +52,18 @@ static void do_clear_recovery_mode_switch(void *unused)
 BOOT_STATE_INIT_ENTRY(BS_WRITE_TABLES, BS_ON_ENTRY,
 		      do_clear_recovery_mode_switch, NULL);
 
+static void vboot_clear_recovery_request(void *unused)
+{
+	struct vb2_context *ctx;
+
+	ctx = vboot_get_context();
+	vb2api_clear_recovery(ctx);
+	save_vbnv(ctx->nvdata);
+}
+
+BOOT_STATE_INIT_ENTRY(BS_POST_DEVICE, BS_ON_ENTRY,
+		      vboot_clear_recovery_request, NULL);
+
 int __weak get_recovery_mode_retrain_switch(void)
 {
 	return 0;
diff --git a/src/security/vboot/vboot_common.h b/src/security/vboot/vboot_common.h
index ed3b69a54d1..e4f8fc1643d 100644
--- a/src/security/vboot/vboot_common.h
+++ b/src/security/vboot/vboot_common.h
@@ -12,10 +12,6 @@
  */
 int vboot_check_recovery_request(void);
 
-/*
- * Function to clear the recovery request and update the VBNV.
- */
-void vboot_clear_recovery_request(void);
 
 /* ============================ VBOOT REBOOT ============================== */
 /*
diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c
index 2230b5ab577..9dbd03c5393 100644
--- a/src/security/vboot/vboot_logic.c
+++ b/src/security/vboot/vboot_logic.c
@@ -260,6 +260,9 @@ void verstage_main(void)
 	/* Initialize and read nvdata from non-volatile storage. */
 	vbnv_init(ctx->nvdata);
 
+	if (!CONFIG(VBOOT_SLOTS_RW_AB))
+		ctx->flags |= VB2_CONTEXT_SLOT_A_ONLY;
+
 	/* Set S3 resume flag if vboot should behave differently when selecting
 	 * which slot to boot.  This is only relevant to vboot if the platform
 	 * does verification of memory init and thus must ensure it resumes with