diff --git a/components/bootloader_support/include/esp_efuse.h b/components/bootloader_support/include/esp_efuse.h
index 41588396c4..2f33b05a98 100644
--- a/components/bootloader_support/include/esp_efuse.h
+++ b/components/bootloader_support/include/esp_efuse.h
@@ -48,6 +48,16 @@ void esp_efuse_burn_new_values(void);
  */
 void esp_efuse_reset(void);
 
+/* @brief Disable BASIC ROM Console via efuse
+ *
+ * By default, if booting from flash fails the ESP32 will boot a
+ * BASIC console in ROM.
+ *
+ * Call this function (from bootloader or app) to permanently
+ * disable the console on this chip.
+ */
+void esp_efuse_disable_basic_rom_console(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/bootloader_support/src/efuse.c b/components/bootloader_support/src/efuse.c
index e90ba1b7f6..40bb6d451e 100644
--- a/components/bootloader_support/src/efuse.c
+++ b/components/bootloader_support/src/efuse.c
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 #include "esp_efuse.h"
+#include "esp_log.h"
 
 #define EFUSE_CONF_WRITE 0x5A5A /* efuse_pgm_op_ena, force no rd/wr disable */
 #define EFUSE_CONF_READ 0x5AA5 /* efuse_read_op_ena, release force */
@@ -19,6 +20,8 @@
 #define EFUSE_CMD_PGM 0x02
 #define EFUSE_CMD_READ 0x01
 
+static const char *TAG = "efuse";
+
 void esp_efuse_burn_new_values(void)
 {
     REG_WRITE(EFUSE_CONF_REG, EFUSE_CONF_WRITE);
@@ -45,3 +48,13 @@ void esp_efuse_reset(void)
       }
     }
 }
+
+void esp_efuse_disable_basic_rom_console(void)
+{
+    if ((REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_RD_CONSOLE_DEBUG_DISABLE) == 0) {
+        ESP_EARLY_LOGI(TAG, "Disable BASIC ROM Console fallback via efuse...");
+        esp_efuse_reset();
+        REG_WRITE(EFUSE_BLK0_WDATA6_REG, EFUSE_RD_CONSOLE_DEBUG_DISABLE);
+        esp_efuse_burn_new_values();
+    }
+}
diff --git a/components/esp32/Kconfig b/components/esp32/Kconfig
index dca22d039a..9c554f9ed9 100644
--- a/components/esp32/Kconfig
+++ b/components/esp32/Kconfig
@@ -604,6 +604,18 @@ config ESP32_XTAL_FREQ
     default 40 if ESP32_XTAL_FREQ_40
     default 26 if ESP32_XTAL_FREQ_26
 
+config DISABLE_BASIC_ROM_CONSOLE
+    bool "Permanently disable BASIC ROM Console"
+    default n
+    help
+        If set, the first time the app boots it will disable the BASIC ROM Console
+        permanently (by burning an efuse).
+
+        Otherwise, the BASIC ROM Console starts on reset if no valid bootloader is
+        read from the flash.
+
+        (Enabling secure boot also disables the BASIC ROM Console by default.)
+
 config NO_BLOBS
     bool "No Binary Blobs"
     depends on !BT_ENABLED
@@ -624,7 +636,7 @@ config ESP_TIMER_PROFILING
 		used for timer storage, and should only be used for debugging/testing
 		purposes.
 
-endmenu
+endmenu  # ESP32-Specific
 
 menu Wi-Fi
 
@@ -748,10 +760,10 @@ config ESP32_WIFI_NVS_ENABLED
     help
         Select this option to enable WiFi NVS flash
 
-endmenu
+endmenu  # Wi-Fi
 
 menu Phy
-	
+
 config ESP32_PHY_CALIBRATION_AND_DATA_STORAGE
     bool "Do phy calibration and store calibration data in NVS"
     default y
@@ -790,4 +802,4 @@ config ESP32_PHY_MAX_TX_POWER
 	int
 	default ESP32_PHY_MAX_WIFI_TX_POWER
 
-endmenu
+endmenu  # PHY
diff --git a/components/esp32/cpu_start.c b/components/esp32/cpu_start.c
index 7fec14f3c3..02745f3c11 100644
--- a/components/esp32/cpu_start.c
+++ b/components/esp32/cpu_start.c
@@ -62,6 +62,7 @@
 #include "esp_panic.h"
 #include "esp_core_dump.h"
 #include "esp_app_trace.h"
+#include "esp_efuse.h"
 #include "esp_clk.h"
 #include "esp_timer.h"
 #include "trax.h"
@@ -244,6 +245,9 @@ void start_cpu0_default(void)
 #endif
 #if CONFIG_BROWNOUT_DET
     esp_brownout_init();
+#endif
+#if CONFIG_DISABLE_BASIC_ROM_CONSOLE
+    esp_efuse_disable_basic_rom_console();
 #endif
     rtc_gpio_force_hold_dis_all();
     esp_vfs_dev_uart_register();