diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c
index 5ea4916..10993d3 100644
--- a/src/security/vboot/vboot_logic.c
+++ b/src/security/vboot/vboot_logic.c
@@ -244,12 +244,7 @@
 	default:
 		printk(BIOS_ERR,
 		       "Communication error in getting Cr50 boot mode.\n");
-		if (ctx->flags & VB2_CONTEXT_RECOVERY_MODE)
-			/* Continue to boot in recovery mode */
-			return;
 		vb2api_fail(ctx, VB2_RECOVERY_CR50_BOOT_MODE, rv);
-		vboot_save_data(ctx);
-		vboot_reboot();
 		return;
 	}
 
@@ -321,6 +316,17 @@
 	if (!CONFIG(VBOOT_MUST_REQUEST_DISPLAY) || CONFIG(VBOOT_ALWAYS_ENABLE_DISPLAY))
 		ctx->flags |= VB2_CONTEXT_DISPLAY_INIT;
 
+	/*
+	 * Get boot mode from GSC. This allows us to refuse to boot OS
+	 * (with VB2_CONTEXT_NO_BOOT) or to switch to developer mode (with
+	 * !VB2_CONTEXT_EC_TRUSTED).
+	 *
+	 * If there is an communication error, a recovery reason will be set and
+	 * vb2api_fw_phase1 will route us to recovery mode.
+	 */
+	if (CONFIG(TPM_CR50))
+		check_boot_mode(ctx);
+
 	/* Do early init (set up secdata and NVRAM, load GBB) */
 	printk(BIOS_INFO, "Phase 1\n");
 	rv = vb2api_fw_phase1(ctx);
@@ -391,9 +397,6 @@
 		timestamp_add_now(TS_END_TPMPCR);
 	}
 
-	if (CONFIG(TPM_CR50))
-		check_boot_mode(ctx);
-
 	/* Lock TPM */
 
 	timestamp_add_now(TS_START_TPMLOCK);