diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 44203ff..964bab1 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -43,7 +43,7 @@
 #include <asm/irq_regs.h>
 
 /* Whether we react on sysrq keys or just ignore them */
-int __read_mostly __sysrq_enabled = 1;
+int __read_mostly __sysrq_enabled = CONFIG_MAGIC_SYSRQ_DEFAULT_MASK;
 
 static int __read_mostly sysrq_always_enabled;
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 234ceb1..415a834 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -50,6 +50,14 @@ config MAGIC_SYSRQ
 	  keys are documented in <file:Documentation/sysrq.txt>. Don't say Y
 	  unless you really know what this hack does.
 
+config MAGIC_SYSRQ_DEFAULT_MASK
+	hex "Default mask for Magic SysRq keys on the console"
+	depends on MAGIC_SYSRQ
+	default 1
+	help
+	  Specifies the default mask for the allowed SysRq keys.  This can be
+	  used to disable several sensitive keys by default.
+
 config STRIP_ASM_SYMS
 	bool "Strip assembler-generated symbols during link"
 	default n