diff --git a/etc/default/grub.d/random.trust_cpu.cfg b/etc/default/grub.d/random.trust_cpu.cfg
new file mode 100644
index 00000000..1bd922ea
--- /dev/null
+++ b/etc/default/grub.d/random.trust_cpu.cfg
@@ -0,0 +1,4 @@
+# Trust CPU random number generator, possibly controversial, but possibly
+# safe due to not being the only source of entropy
+# https://en.wikipedia.org/wiki/RDRAND#Reception
+GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT random.trust_cpu=on"