diff --git a/src/bootctl/bootctl-reboot-to-firmware.c b/src/bootctl/bootctl-reboot-to-firmware.c
index 9b85f02232..be20a4a132 100644
--- a/src/bootctl/bootctl-reboot-to-firmware.c
+++ b/src/bootctl/bootctl-reboot-to-firmware.c
@@ -6,6 +6,7 @@
 #include "sd-varlink.h"
 
 #include "bootctl-reboot-to-firmware.h"
+#include "bootctl-util.h"
 #include "efi-api.h"
 #include "errno-util.h"
 #include "log.h"
@@ -14,6 +15,10 @@
 int verb_reboot_to_firmware(int argc, char *argv[], void *userdata) {
         int r;
 
+        r = verify_touch_variables_allowed(argv[0]);
+        if (r < 0)
+                return r;
+
         if (argc < 2) {
                 r = efi_get_reboot_to_firmware();
                 if (r > 0) {