diff --git a/config/coreboot/default/patches/0047-nb-haswell-lock-policy-regs-when-disabling-IOMMU.patch b/config/coreboot/default/patches/0047-nb-haswell-lock-policy-regs-when-disabling-IOMMU.patch
new file mode 100644
index 00000000..a7af707e
--- /dev/null
+++ b/config/coreboot/default/patches/0047-nb-haswell-lock-policy-regs-when-disabling-IOMMU.patch
@@ -0,0 +1,55 @@
+From fa4f05e39744eb4c4606f940b8acc7fd053b11d4 Mon Sep 17 00:00:00 2001
+From: Leah Rowe <info@minifree.org>
+Date: Sat, 4 May 2024 02:00:53 +0100
+Subject: [PATCH 1/1] nb/haswell: lock policy regs when disabling IOMMU
+
+Angel Pons told me I should do it. See comments here:
+https://review.coreboot.org/c/coreboot/+/81016
+
+I see no harm in complying with the request. I'll merge
+this into the main patch at a later date and try to
+get this upstreamed.
+
+Just a reminder: on Optiplex 9020 variants, Xorg locks up
+under Linux when tested with a graphics card; disabling
+IOMMU works around the issue. Intel graphics work just fine
+with IOMMU turned on. Libreboot disables IOMMU by default,
+on the 9020, so that users can install graphics cards easily.
+
+Signed-off-by: Leah Rowe <info@minifree.org>
+---
+ src/northbridge/intel/haswell/early_init.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/src/northbridge/intel/haswell/early_init.c b/src/northbridge/intel/haswell/early_init.c
+index 1a7e0b1076..e9506ee830 100644
+--- a/src/northbridge/intel/haswell/early_init.c
++++ b/src/northbridge/intel/haswell/early_init.c
+@@ -160,17 +160,16 @@ static void haswell_setup_iommu(void)
+ 	const u32 capid0_a = pci_read_config32(HOST_BRIDGE, CAPID0_A);
+ 	u8 enable_iommu = get_uint_option("iommu", 1);
+ 
+-	if (!enable_iommu)
+-		return;
+-
+ 	if (capid0_a & VTD_DISABLE)
+ 		return;
+ 
+-	/* Setup BARs: zeroize top 32 bits; set enable bit */
+-	mchbar_write32(GFXVTBAR + 4, GFXVT_BASE_ADDRESS >> 32);
+-	mchbar_write32(GFXVTBAR + 0, GFXVT_BASE_ADDRESS | 1);
+-	mchbar_write32(VTVC0BAR + 4, VTVC0_BASE_ADDRESS >> 32);
+-	mchbar_write32(VTVC0BAR + 0, VTVC0_BASE_ADDRESS | 1);
++	if (enable_iommu) {
++		/* Setup BARs: zeroize top 32 bits; set enable bit */
++		mchbar_write32(GFXVTBAR + 4, GFXVT_BASE_ADDRESS >> 32);
++		mchbar_write32(GFXVTBAR + 0, GFXVT_BASE_ADDRESS | 1);
++		mchbar_write32(VTVC0BAR + 4, VTVC0_BASE_ADDRESS >> 32);
++		mchbar_write32(VTVC0BAR + 0, VTVC0_BASE_ADDRESS | 1);
++	}
+ 
+ 	/* Set L3HIT2PEND_DIS, lock GFXVTBAR policy config registers */
+ 	u32 reg32;
+-- 
+2.39.2
+
diff --git a/config/coreboot/haswell/patches/0027-nb-haswell-lock-policy-regs-when-disabling-IOMMU.patch b/config/coreboot/haswell/patches/0027-nb-haswell-lock-policy-regs-when-disabling-IOMMU.patch
new file mode 100644
index 00000000..9b6020a2
--- /dev/null
+++ b/config/coreboot/haswell/patches/0027-nb-haswell-lock-policy-regs-when-disabling-IOMMU.patch
@@ -0,0 +1,55 @@
+From b75d9e385137b3b561fc7220c04f742817d319b2 Mon Sep 17 00:00:00 2001
+From: Leah Rowe <info@minifree.org>
+Date: Sat, 4 May 2024 02:00:53 +0100
+Subject: [PATCH 1/1] nb/haswell: lock policy regs when disabling IOMMU
+
+Angel Pons told me I should do it. See comments here:
+https://review.coreboot.org/c/coreboot/+/81016
+
+I see no harm in complying with the request. I'll merge
+this into the main patch at a later date and try to
+get this upstreamed.
+
+Just a reminder: on Optiplex 9020 variants, Xorg locks up
+under Linux when tested with a graphics card; disabling
+IOMMU works around the issue. Intel graphics work just fine
+with IOMMU turned on. Libreboot disables IOMMU by default,
+on the 9020, so that users can install graphics cards easily.
+
+Signed-off-by: Leah Rowe <info@minifree.org>
+---
+ src/northbridge/intel/haswell/early_init.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/src/northbridge/intel/haswell/early_init.c b/src/northbridge/intel/haswell/early_init.c
+index 1a7e0b1076..e9506ee830 100644
+--- a/src/northbridge/intel/haswell/early_init.c
++++ b/src/northbridge/intel/haswell/early_init.c
+@@ -160,17 +160,16 @@ static void haswell_setup_iommu(void)
+ 	const u32 capid0_a = pci_read_config32(HOST_BRIDGE, CAPID0_A);
+ 	u8 enable_iommu = get_uint_option("iommu", 1);
+ 
+-	if (!enable_iommu)
+-		return;
+-
+ 	if (capid0_a & VTD_DISABLE)
+ 		return;
+ 
+-	/* Setup BARs: zeroize top 32 bits; set enable bit */
+-	mchbar_write32(GFXVTBAR + 4, GFXVT_BASE_ADDRESS >> 32);
+-	mchbar_write32(GFXVTBAR + 0, GFXVT_BASE_ADDRESS | 1);
+-	mchbar_write32(VTVC0BAR + 4, VTVC0_BASE_ADDRESS >> 32);
+-	mchbar_write32(VTVC0BAR + 0, VTVC0_BASE_ADDRESS | 1);
++	if (enable_iommu) {
++		/* Setup BARs: zeroize top 32 bits; set enable bit */
++		mchbar_write32(GFXVTBAR + 4, GFXVT_BASE_ADDRESS >> 32);
++		mchbar_write32(GFXVTBAR + 0, GFXVT_BASE_ADDRESS | 1);
++		mchbar_write32(VTVC0BAR + 4, VTVC0_BASE_ADDRESS >> 32);
++		mchbar_write32(VTVC0BAR + 0, VTVC0_BASE_ADDRESS | 1);
++	}
+ 
+ 	/* Set L3HIT2PEND_DIS, lock GFXVTBAR policy config registers */
+ 	u32 reg32;
+-- 
+2.39.2
+