diff --git a/0021-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch b/0021-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
new file mode 100644
index 0000000..b9fab3c
--- /dev/null
+++ b/0021-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
@@ -0,0 +1,100 @@
+From 5aa243d95f64d6febe7724d7281471b3528e0961 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 25 Sep 2023 09:48:46 +0200
+Subject: [PATCH 21/21] OvmfPkg: set PcdVariableStoreSize +
+ PcdMaxVolatileVariableSize unconditionally
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 10 ----------
+ OvmfPkg/OvmfPkgIa32X64.dsc | 10 ----------
+ OvmfPkg/OvmfPkgX64.dsc     | 10 ----------
+ 3 files changed, 30 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 9cd981ae7be8..1f610b00eb0b 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -493,23 +493,13 @@ [PcdsFixedAtBuild]
+ !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+-  # match PcdFlashNvStorageVariableSize purely for convenience
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
+-!endif
+ !endif
+ !if $(FD_SIZE_IN_KB) == 4096
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+-  # match PcdFlashNvStorageVariableSize purely for convenience
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
+ !endif
+-!endif
+-!if $(NETWORK_TLS_ENABLE) == TRUE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
+-!endif
+ 
+   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 9186ab2ba83b..d68acc88d702 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -500,23 +500,13 @@ [PcdsFixedAtBuild]
+ !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+-  # match PcdFlashNvStorageVariableSize purely for convenience
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
+-!endif
+ !endif
+ !if $(FD_SIZE_IN_KB) == 4096
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+-  # match PcdFlashNvStorageVariableSize purely for convenience
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
+ !endif
+-!endif
+-!if $(NETWORK_TLS_ENABLE) == TRUE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
+-!endif
+ 
+   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index a059f143f5be..1e6363e0de2e 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -519,23 +519,13 @@ [PcdsFixedAtBuild]
+ !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+-  # match PcdFlashNvStorageVariableSize purely for convenience
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
+-!endif
+ !endif
+ !if $(FD_SIZE_IN_KB) == 4096
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+-  # match PcdFlashNvStorageVariableSize purely for convenience
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
+ !endif
+-!endif
+-!if $(NETWORK_TLS_ENABLE) == TRUE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
+   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
+-!endif
+ 
+   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
+-- 
+2.41.0
+
diff --git a/edk2.spec b/edk2.spec
index e403e3e..895e730 100644
--- a/edk2.spec
+++ b/edk2.spec
@@ -113,6 +113,7 @@ Patch0017: 0017-OvmfPkg-IoMmuDxe-don-t-rely-on-TPLs-to-manage-concur.patch
 Patch0018: 0018-OvmfPkg-Disable-PcdFirstTimeWakeUpAPsBySipi.patch
 Patch0019: 0019-OvmfPkg-AmdSev-Disable-PcdFirstTimeWakeUpAPsBySipi.patch
 Patch0020: 0020-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch
+Patch0021: 0021-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
 
 
 # python3-devel and libuuid-devel are required for building tools.