diff --git a/tests/sanity/main.fmf b/tests/sanity/main.fmf
index 5cec1d7..e6118f7 100644
--- a/tests/sanity/main.fmf
+++ b/tests/sanity/main.fmf
@@ -8,6 +8,7 @@ test: ./runtest.sh
 framework: beakerlib
 require:
   - s390utils-base
+  - xxd
 duration: 5m
 enabled: true
 adjust:
diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh
index 5885c69..dc889e4 100755
--- a/tests/sanity/runtest.sh
+++ b/tests/sanity/runtest.sh
@@ -31,6 +31,7 @@
 PACKAGE="s390utils-base"
 
 EXTRACT="$PWD/extract-module-sig.pl"
+STAGE3="/usr/lib/s390-tools/stage3.bin"
 
 rlJournalStart
     rlPhaseStartSetup
@@ -171,9 +172,10 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "Bootloader signature"
+        rlRun "xxd -s 16380 -l 4 -g 4 $STAGE3 | grep -q zIPL" 0 "Check SecureBoot trailer presence"
         # only RHEL has signed bootloader
         if rlIsRHEL '>=8'; then
-            rlRun "$EXTRACT -s /usr/lib/s390-tools/stage3.bin > stage3.bin.sig" 0 "Check bootloader signature"
+            rlRun "$EXTRACT -s $STAGE3 > stage3.bin.sig" 0 "Check bootloader signature"
         else
             rlLog "Skipping bootloader signature check, not on RHEL"
         fi