diff --git a/nugget/proto/nugget/app/keymaster/keymaster.proto b/nugget/proto/nugget/app/keymaster/keymaster.proto
index 67f464a..89710e6 100644
--- a/nugget/proto/nugget/app/keymaster/keymaster.proto
+++ b/nugget/proto/nugget/app/keymaster/keymaster.proto
@@ -413,6 +413,7 @@
   uint32 system_version = 4;         // Deprecated.
   uint32 system_security_level = 5;  // Patch level of the boot partition.
   bytes boot_hash = 6;               // This is a SHA256 digest.
+  uint32 boot_security_level = 7;
 }
 message SetBootStateResponse {
   // Specified in keymaster_defs.proto:ErrorCode
diff --git a/nugget/proto/nugget/app/keymaster/keymaster_defs.proto b/nugget/proto/nugget/app/keymaster/keymaster_defs.proto
index 66d1801..dfdfeeb 100644
--- a/nugget/proto/nugget/app/keymaster/keymaster_defs.proto
+++ b/nugget/proto/nugget/app/keymaster/keymaster_defs.proto
@@ -321,6 +321,7 @@
     FUSING_PVT_1 = 3;   // Strongbox gen v1 certs.
     FUSING_D_PVT = 4;   // Dauntless gen v0 certs.
     FUSING_D_PVT_1 = 5; // Dauntless gen v1 certs.
+    FUSING_D_PVT_2 = 6; // Dauntless gen v2 certs (D3M2).
 }
 
 enum CertificateStatus {