diff --git a/0001-BaseTools-pin-the-X64-ISA-baseline-to-x86-64-v2.patch b/0001-BaseTools-pin-the-X64-ISA-baseline-to-x86-64-v2.patch
new file mode 100644
index 0000000..d9d4f92
--- /dev/null
+++ b/0001-BaseTools-pin-the-X64-ISA-baseline-to-x86-64-v2.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Eduard Abdullin <eabdullin@almalinux.org>
+Date: Wed, 12 Aug 2026 13:58:37 +0300
+Subject: [PATCH] BaseTools: pin the X64 ISA baseline to x86-64-v2 (AlmaLinux
+ only)
+
+edk2 does not pass -march for the X64 toolchains, unlike IA32 which is
+pinned to -march=i586 right next to it, so the ISA baseline of the
+generated firmware is whatever the build host's compiler happens to
+default to.  RHEL 10 and AlmaLinux 10 build GCC with
+--with-arch_64=x86-64-v3, so OVMF ends up carrying BMI1 instructions and
+the firmware dies on a x86-64-v2 CPU: the guest resets in a loop right
+after the SEC phase, before anything is printed on the console.
+
+Note that %{optflags} does not help here.  edk2.spec exports it as
+EXTRA_OPTFLAGS, which only reaches the host BaseTools binaries, and
+edk2-build.py has no way to pass compiler flags to the firmware build,
+so tools_def is the only place where this can be fixed.
+
+The edk2-ovmf subpackage is noarch and one build is shared by the x86_64
+and the x86_64_v2 repositories, so the shipped firmware has to be built
+for the lower baseline.  Pin the X64 CC flags to -march=x86-64-v2: guest
+firmware must not inherit the ISA baseline of the machine that built it.
+x86-64-v2 code runs unmodified on v3 and v4 CPUs, and firmware is not a
+hot path, so there is no practical cost for x86_64 users.
+
+https://git.almalinux.org/rpms/edk2/issues/1
+
+Signed-off-by: Eduard Abdullin <eabdullin@almalinux.org>
+---
+ BaseTools/Conf/tools_def.template | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
+--- a/BaseTools/Conf/tools_def.template
++++ b/BaseTools/Conf/tools_def.template
+@@ -865,7 +865,7 @@ DEFINE GCC_DEPS_FLAGS              = -MMD -MF $@.deps
+ DEFINE GCC48_ALL_CC_FLAGS            = DEF(GCC_ALL_CC_FLAGS) -ffunction-sections -fdata-sections -DSTRING_ARRAY_NAME=$(BASE_NAME)Strings
+ DEFINE GCC48_IA32_X64_DLINK_COMMON   = -nostdlib -Wl,-n,-q,--gc-sections -z common-page-size=0x20
+ DEFINE GCC48_IA32_CC_FLAGS           = DEF(GCC48_ALL_CC_FLAGS) DEF(GCC_IA32_X64_CC_FLAGS) -m32 -march=i586 -malign-double -D EFI32 -fno-asynchronous-unwind-tables -Wno-address -fno-omit-frame-pointer
+-DEFINE GCC48_X64_CC_FLAGS            = DEF(GCC48_ALL_CC_FLAGS) DEF(GCC_IA32_X64_CC_FLAGS) -m64 "-DEFIAPI=__attribute__((ms_abi))" -maccumulate-outgoing-args -mno-red-zone -Wno-address -mcmodel=small -fpie -fno-asynchronous-unwind-tables -Wno-address  -fno-omit-frame-pointer
++DEFINE GCC48_X64_CC_FLAGS            = DEF(GCC48_ALL_CC_FLAGS) DEF(GCC_IA32_X64_CC_FLAGS) -m64 -march=x86-64-v2 "-DEFIAPI=__attribute__((ms_abi))" -maccumulate-outgoing-args -mno-red-zone -Wno-address -mcmodel=small -fpie -fno-asynchronous-unwind-tables -Wno-address  -fno-omit-frame-pointer
+ DEFINE GCC48_IA32_X64_ASLDLINK_FLAGS = DEF(GCC48_IA32_X64_DLINK_COMMON) -Wl,--entry,ReferenceAcpiTable -u ReferenceAcpiTable
+ DEFINE GCC48_IA32_X64_DLINK_FLAGS    = DEF(GCC48_IA32_X64_DLINK_COMMON) -Wl,--entry,$(IMAGE_ENTRY_POINT) -u $(IMAGE_ENTRY_POINT) -Wl,-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map,--whole-archive
+ DEFINE GCC48_IA32_DLINK2_FLAGS       = -Wl,--defsym=PECOFF_HEADER_SIZE=0x220 DEF(GCC_DLINK2_FLAGS_COMMON)
diff --git a/edk2.spec b/edk2.spec
index 58f3b29..748a5af 100644
--- a/edk2.spec
+++ b/edk2.spec
@@ -25,7 +25,7 @@ ExclusiveArch: x86_64 aarch64 riscv64
 
 Name:       edk2
 Version:    %{GITDATE}
-Release:    6%{?dist}
+Release:    6%{?dist}.alma.1
 Summary:    UEFI firmware for 64-bit virtual machines
 License:    BSD-2-Clause-Patent and Apache-2.0 and MIT
 URL:        http://www.tianocore.org
@@ -98,6 +98,9 @@ Patch29: edk2-Revert-MdeModulePkg-PciBusDxe-Degrade-MEM64-to-PMEM6.patch
 # For RHEL-220548 - [RHEL 10.3] TDX Secure Boot Setup Mode with OVMF.inteltdx.secboot.fd
 Patch30: edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch
 
+# AlmaLinux Patch
+Patch31: 0001-BaseTools-pin-the-X64-ISA-baseline-to-x86-64-v2.patch
+
 # python3-devel and libuuid-devel are required for building tools.
 # python3-devel is also needed for varstore template generation and
 # verification with "ovmf-vars-generator".
@@ -493,6 +496,9 @@ install -m 0644 \
 
 
 %changelog
+* Wed Aug 12 2026 Eduard Abdullin <eabdullin@almalinux.org> - 20260221-6.alma.1
+- Pin the X64 firmware ISA baseline to x86-64-v2
+
 * Mon Aug 03 2026 Miroslav Rezanina <mrezanin@redhat.com> - 20260221-6
 - edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch [RHEL-220548]
 - Resolves: RHEL-220548