Signed-off-by: Andrea Bolognani <abologna@redhat.com>
---
 NEWS.rst | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/NEWS.rst b/NEWS.rst
index 54f541cdbc..2bbdc52c03 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -17,6 +17,22 @@ v12.1.0 (unreleased)
 
 * **New features**
 
+  * qemu: Add support for uefi-vars device and firmware builds using it
+
+    This is particularly noteworthy for people running aarch64 VMs, as it makes
+    it finally possible to use Secure Boot on the architecture.
+
+    In most cases, no special steps are needed to take advantage of this:
+    assuming that you have installed a recent version of QEMU, as well as a
+    build of edk2 that includes the necessary binaries, you can just `enable
+    Secure Boot <kbase/secureboot.html>`__ as you normally would.
+
+    To explicitly request that the uefi-vars device is used even for scenarios
+    where that would normally not be the case, it's enough to add an empty
+    ``<varstore/>`` element in the domain XML. More details are available in
+    the `guest firmware configuration <formatdomain.html#guest-firmware>`__
+    section of the documentation.
+
 * **Improvements**
 
 * **Bug fixes**
-- 
2.53.0