diff --git a/OvmfPkg/PlatformPei/MemDetect.c b/OvmfPkg/PlatformPei/MemDetect.c
index c1350b931f..15b279e445 100644
--- a/OvmfPkg/PlatformPei/MemDetect.c
+++ b/OvmfPkg/PlatformPei/MemDetect.c
@@ -218,13 +218,19 @@ InitializeRamRegions (
       EfiACPIMemoryNVS
       );
 #endif
+  }
 
+  if (mBootMode != BOOT_ON_S3_RESUME) {
     //
     // Reserve the lock box storage area
     //
     // Since this memory range will be used on S3 resume, it must be
     // reserved as ACPI NVS.
     //
+    // If S3 is unsupported, then various drivers might still write to the
+    // LockBox area. We ought to prevent DXE from serving allocation requests
+    // such that they would overlap the LockBox storage.
+    //
     ZeroMem (
       (VOID*)(UINTN) PcdGet32 (PcdOvmfLockBoxStorageBase),
       (UINTN) PcdGet32 (PcdOvmfLockBoxStorageSize)
@@ -232,7 +238,7 @@ InitializeRamRegions (
     BuildMemoryAllocationHob (
       (EFI_PHYSICAL_ADDRESS)(UINTN) PcdGet32 (PcdOvmfLockBoxStorageBase),
       (UINT64)(UINTN) PcdGet32 (PcdOvmfLockBoxStorageSize),
-      EfiACPIMemoryNVS
+      mS3Supported ? EfiACPIMemoryNVS : EfiBootServicesData
       );
   }
 }