diff --git a/builder/vsphere/driver/vm.go b/builder/vsphere/driver/vm.go
index 2c1543932..03c58d3bb 100644
--- a/builder/vsphere/driver/vm.go
+++ b/builder/vsphere/driver/vm.go
@@ -70,7 +70,7 @@ type CreateConfig struct {
 	NICs          []NIC
 	USBController bool
 	Version       uint   // example: 10
-	Firmware      string // efi or bios
+	Firmware      string // efi-secure, efi or bios
 	Storage       []Disk
 }
 
@@ -107,7 +107,12 @@ func (d *Driver) CreateVM(config *CreateConfig) (*VirtualMachine, error) {
 	if config.Version != 0 {
 		createSpec.Version = fmt.Sprintf("%s%d", "vmx-", config.Version)
 	}
-	if config.Firmware != "" {
+	if config.Firmware == "efi-secure" {
+		createSpec.Firmware = "efi"
+		createSpec.BootOptions = &types.VirtualMachineBootOptions{
+			EfiSecureBootEnabled: types.NewBool(true),
+		}
+	} else if config.Firmware != "" {
 		createSpec.Firmware = config.Firmware
 	}
 
diff --git a/builder/vsphere/iso/step_create.go b/builder/vsphere/iso/step_create.go
index 6d179ecfc..701910fd7 100644
--- a/builder/vsphere/iso/step_create.go
+++ b/builder/vsphere/iso/step_create.go
@@ -74,7 +74,7 @@ type CreateConfig struct {
 	// here](https://code.vmware.com/apis/358/vsphere/doc/vim.vm.GuestOsDescriptor.GuestOsIdentifier.html)
 	// for a full list of possible values.
 	GuestOSType string `mapstructure:"guest_os_type"`
-	// Set the Firmware at machine creation. Example `efi`. Defaults to `bios`.
+	// Set the Firmware at machine creation. Supported values: `bios`, `efi` or `efi-secure`. Defaults to `bios`.
 	Firmware string `mapstructure:"firmware"`
 	// Set VM disk controller type. Example `pvscsi`.
 	DiskControllerType string `mapstructure:"disk_controller_type"`
@@ -115,8 +115,8 @@ func (c *CreateConfig) Prepare() []error {
 		c.GuestOSType = "otherGuest"
 	}
 
-	if c.Firmware != "" && c.Firmware != "bios" && c.Firmware != "efi" {
-		errs = append(errs, fmt.Errorf("'firmware' must be 'bios' or 'efi'"))
+	if c.Firmware != "" && c.Firmware != "bios" && c.Firmware != "efi" && c.Firmware != "efi-secure" {
+		errs = append(errs, fmt.Errorf("'firmware' must be 'bios', 'efi' or 'efi-secure'"))
 	}
 
 	return errs
diff --git a/website/pages/partials/builder/vsphere/iso/CreateConfig-not-required.mdx b/website/pages/partials/builder/vsphere/iso/CreateConfig-not-required.mdx
index b3524f079..705ee483e 100644
--- a/website/pages/partials/builder/vsphere/iso/CreateConfig-not-required.mdx
+++ b/website/pages/partials/builder/vsphere/iso/CreateConfig-not-required.mdx
@@ -9,7 +9,7 @@
     here](https://code.vmware.com/apis/358/vsphere/doc/vim.vm.GuestOsDescriptor.GuestOsIdentifier.html)
     for a full list of possible values.
     
--   `firmware` (string) - Set the Firmware at machine creation. Example `efi`. Defaults to `bios`.
+-   `firmware` (string) - Set the Firmware at machine creation. Supported values: `bios`, `efi` or `efi-secure`. Defaults to `bios`.
     
 -   `disk_controller_type` (string) - Set VM disk controller type. Example `pvscsi`.