diff --git a/build/linker/x86_64.ld b/build/linker/x86_64.ld
index 6a34060a1..c0c69a829 100644
--- a/build/linker/x86_64.ld
+++ b/build/linker/x86_64.ld
@@ -4,15 +4,16 @@
 
 ENTRY(_start)
 
-/* 16 MiB. Modern UEFI firmware on x86_64 (OVMF on QEMU, real-world
- * EDK2 builds, Lenovo / Dell / HP firmware) typically reserves the
- * 0–16 MiB range for its own code, ACPI tables, and BootServices
- * data. Loading the kernel above that line keeps the .data + .bss
+/* 32 MiB. Modern UEFI firmware on x86_64 (OVMF on QEMU, real-world
+ * EDK2 builds, Lenovo / Dell / HP firmware) can reserve low memory for
+ * code, ACPI tables, BootServices data, and SMM communication buffers.
+ * Secure Boot OVMF with SMM reserves through 26 MiB. Loading the kernel
+ * above that line keeps the .data + .bss
  * LOAD segment (~38 MiB once the 32-MiB static heap arena is
  * accounted for) inside contiguous EfiConventionalMemory. The PVH
  * direct-boot path (QEMU `-kernel`) honours the same ELF p_paddr,
  * so this works for both protocols. */
-KERNEL_LOAD_BASE = 0x1000000;
+KERNEL_LOAD_BASE = 0x2000000;
 KERNEL_VIRT_BASE = 0xFFFFFFFF80000000;
 
 /* VA span reserved for the kernel image. The module text window begins
diff --git a/build/specification/spec.md b/build/specification/spec.md
index 99e41c3b1..159a69786 100644
--- a/build/specification/spec.md
+++ b/build/specification/spec.md
@@ -239,6 +239,9 @@ and CI compiler-cache integration.
 - Kernel ELFs on both architectures carry a deterministic SHA-1 GNU build-ID;
   linker symbols `__build_id_note_start` and `__build_id_note_end` delimit the
   retained note for `/sys/kernel/notes`.
+- The x86_64 ELF uses a 32 MiB physical load base for both PVH and
+  Multiboot2. This keeps its fixed load span above the low-memory ACPI NVS and
+  SMM communication reservations exposed by Secure Boot OVMF.
 - Workspace: single Cargo workspace so Global LTO spans everything.
 
 ## 4. Invariants & safety properties
diff --git a/build/xtask/src/main.rs b/build/xtask/src/main.rs
index 792b1098d..706e0871a 100644
--- a/build/xtask/src/main.rs
+++ b/build/xtask/src/main.rs
@@ -9982,7 +9982,7 @@ interface_resolution: 1024x768
          \x20 probes.\n\
          \x20 -cpu max is required: the kernel uses RDTSCP / RDSEED / etc. that the\n\
          \x20 default qemu64 model doesn't expose.\n\
-         \x20 -m 1024M leaves room for the kernel image (~52 MiB at LOAD_BASE 16 MiB)\n\
+         \x20 -m 1024M leaves room for the kernel image (~52 MiB at LOAD_BASE 32 MiB)\n\
          \x20 + UEFI's reservations + the 32 MiB static heap arena."
     );
     Ok(())