diff --git a/debian/securedrop-workstation-grsec/etc/default/grub.d/60-unrestrict-privcmd.cfg b/debian/securedrop-workstation-grsec/etc/default/grub.d/60-unrestrict-privcmd.cfg
new file mode 100644
index 0000000..a9e7f03
--- /dev/null
+++ b/debian/securedrop-workstation-grsec/etc/default/grub.d/60-unrestrict-privcmd.cfg
@@ -0,0 +1,3 @@
+# set xen_privcmd to unrestricted to account for XSA-482 patch
+# see https://github.com/QubesOS/qubes-linux-kernel/pull/1256
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX xen_privcmd.unrestricted"